Elasticsearch

The Dropzone platform integrates with the Elasticsearch security SIEM. Many customers ingest other alert sources into Elasticsearch (e.g. IDPs) and integrate Dropzone into Elasticsearch rather than the source systems.

Create an API Key and Obtain a Cloud ID

Elasticsearch requires an API Key and an Elasticsearch Cloud ID to enable.

To obtain your Elasticsearch Cloud ID, do the following:

• Navigate to your Elastic Cloud home page

• Under the Hosted Deployments section, locate the deployment you wish Dropzone.AI to be able to access

• Click "Open"

• In the upper right of the Overview page, click "Endpoint & API Keys"

• Check "Show Cloud ID"

• Copy the value shown for use later in the Dropzone UI, where it is called "Elasticsearch Cloud ID"

To obtain an API Key, do the following:

• Navigate to your Elastic Cloud home page

• Under the Hosted Deployments section, locate the deployment you wish Dropzone.AI to be able to access

• Click "Open"

• In the Deployment overview page, click "Management" in the bottom left corner

• Click the icon next to Stack Management

• Navigate to API keys

• Click "Create an API key"

• Name the API key something memorable, such as Dropzone.AI

• Under type, select User API key

• Click "Create API Key"

• Copy the API key generated for use later in the Dropzone UI, where it is called "API Key"

Enable Elasticsearch

To enable the Data Source integration, you will need the following information:

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Elasticsearch, then click "Configure"

• Under the Data Source heading, input the Elasticsearch Cloud ID and API Key

• Alternatively, if you are using the Elasticsearch Serverless Projects-Based Model, check the box labeled "Use Elasticsearch Serverless" and input your Elasticsearch endpoint value

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.