Elastic Security (SIEM) Setup for Workbench

Step 1: Enable Console and API Access

Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts and an investigation cannot be initiated. For more information, see Why Expel Asks for Console Access.

1. Open Kibana and use the User Creation Wizard to to create a user for Expel with a role that grants Read privileges to the Indices that host your security logs. For instructions, see: https://www.elastic.co/docs/deploy-manage/users-roles/cloud-organization/user-roles#ech-predefined-roles

2. Make note of the Username and Password for later use.

Step 2: Configure Elastic Security (SIEM) as a Security Device in Workbench

Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.

1. ​Log in to Workbench.

2. In the side menu, navigate to Organization Settings > Security Devices.

3. Select Add Security Device.

4. In the search box, enter “Elastic” and then select the Elastic Security (SIEM) integration.

5. For Where is your device? select Cloud or On-prem.

6. Complete the rest of the fields as follows:

   • Assembler (on-prem only) - select your Assembler from the list.

   • Name - enter a name that might help you more easily identify this integration, such as “CompanyName ElasticSecuritySIEM”; this name will display in Workbench under the Name column, and is a text string that you can filter on.

   • Location - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.

   • Username and Password - enter the credentials you created in Step 1.

   • Server address - enter the Elastic Security endpoint. Be sure to use the Elastic Security endpoint and not the Kibana endpoint.

   • Index - enter: .alerts-security.alerts-default

7. Click Save.

8. On the console access screen, select Set up now.

9. In the Console Login area, enter these details:

   • Console URL - enter the console URL from the Server address in the Connection Settings area above. At the end of the URL, type /login.

   • Username and Password - enter the credentials you created in Step 1.

   • Two-factor secret key (32-character code) - depending on how your organization enforces log-ins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, reach out to your Customer Success Manager (CSM) or to support.

10. Click Save.