AiStrike Documentation
AiStrike Documentation
Breadcrumbs

Elastic

This guide outlines the steps to create an API key in Elastic Cloud's Kibana UI (or equivalent in OpenSearch) and configure the correct permissions to enable full read and monitor access for API-based integrations with AiStrike.◼︎

If you are using an OpenSearch cluster, please share details below:

  • Host & Port: URL {OpenSearch/Elastic Host URL} and port number

  • Authentication: Username/Password [full read access, all indexes, collections] or API Key

  • Firewall Rules: AiStrike IPs to allowlist: 3.135.165.25/32, 3.148.24.98/32, 52.15.138.222/32, 13.201.28.59/32, 3.148.93.249/32, 3.14.192.137/32, 18.223.178.199/32

For Elastic Cloud SIEM, follow the steps below

Required Details

Make sure to collect the following details from your Elastic Cloud deployment:

Elasticsearch Endpoint
→ Click on your Deployment Name in the top navigation (you'll see options like Deployment / Discover), then click "Manage this deployment." Under Applications, click Elasticsearch, then click "Copy Endpoint."

Cloud ID
From the same page, copy the Cloud ID [towards the right side, highlighted in red].

API Key
→ Follow the steps below to generate the API key in Kibana.

Create API Key in Kibana

  1. Log in to your Elastic Cloud deployment with a user who has permission to manage API keys.

  2. Go to Kibana Dashboard → Management → Stack Management → Security → API Keys.

  3. Click "Create API Key".

  4. Set the Name of the API key (e.g., AIStrike_API_Key).

  5. Choose "User API Key".

  6. Toggle "Control security privileges" to define custom access policies.

  7. Provide access to all monitor and read permissions in the cluster. For indices, set names = * and privileges = read, view_index_metadata, monitor.

Sample API Key Policy 

{
  "write-only-role": {
    "cluster": [
      "monitor",
      "monitor_enrich",
      "monitor_inference",
      "monitor_ml",
      "monitor_transform",
      "read_pipeline",
      "read_security"
    ],
    "indices": [
      {
        "names": [
          "*"
        ],
        "privileges": [
          "read",
          "view_index_metadata",
          "monitor"
        ],
        "allow_restricted_indices": false
      }
    ],
    "applications": [],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

  1. Once the policy is added, click "Create API Key". Store the key securely to share with AiStrike.

  2. You're all set! Provide the Cloud ID, Elasticsearch Endpoint, and API Key to the AiStrike team to enable integration.

  3. IP Traffic Filter (AiStrike)

If your deployment has IP-based restrictions, please allow AiStrike IPs. AiStrike IPs for allowlist:

3.135.165.25/32
3.148.24.98/32
3.148.93.249/32
3.14.192.137/32
13.201.28.59/32
18.223.178.199/32
52.15.138.222/32
54.246.180.34/32
63.35.37.74/32
54.220.227.162/32

Follow these steps to create a traffic filter rule set:

  1. Go to the Elastic Cloud console.

  2. Navigate to 'Security' > 'Traffic filters'.

  3. Click 'Create rule set'.

  4. Choose type 'IP address' and enter the required AiStrike IP prefixes.

  5. Save the rule set.

  6. Go to your deployment, click 'Manage deployment'.

  7. In the 'Security' section, click 'Manage traffic filters'.

  8. Associate the created rule set with your deployment.

Note: Ensure you have the correct IP prefixes for AiStrike to avoid connection issues.