Skip to main content

Elastic/ELK Stack

Lacework supports the following alert channels that forward Lacework alerts to your Elastic stack.

Amazon CloudWatch​

Send Lacework alerts to SQS through Amazon CloudWatch and then retrieve the alerts from SQS using a plugin from Elastic.

Create a Lacework Alert Channel for Amazon CloudWatch​

Follow the steps described in Amazon CloudWatch to forward alerts from Lacework to CloudWatch.

Configure CloudWatch​

Follow these steps to add an event source mapping for an Amazon SQS queue and send events via trigger to it. See AWS documentation for details.

  1. Open the Lambda console Functions page.
  2. Choose a function.
  3. Under Add triggers, choose SQS.
  4. Under Configure triggers, configure the event source.
    1. In the SQS queue field, specify the source queue.
    2. In the Batch size field, specify the maximum number of items to read from the queue and send to your function, in a single invocation.
    3. In the Enabled field, clear the checkbox to disable the event source.
  5. Choose Add.
  6. Choose Save.

Configure the Elastic Stack​

See Elastic documentation to configure your Elastic stack to retrieve events from SQS with the sqs-input plugin.

Google Cloud Pub/Sub​

Send Lacework alerts to Google Cloud Pub/Sub and then use Google Dataflow to send data to your Elastic stack.

Create a Lacework Alert Channel for Google Cloud Pub/Sub​

Follow the steps described in Google Cloud Pub/Sub to send alerts from Lacework to Google Pub/Sub.

Configure GCP​

Follow these steps to configure a Dataflow template that sends alerts from Pub/Sub to your Elastic stack.

  1. Install the Elastic GCP integration from the Kibana web interface.
  2. In the Google Cloud Console go to the Dataflow product.
  3. Click Create job from template.
  4. Select Pub/Sub to Elasticsearch from the Dataflow template dropdown menu.
  5. Provide the required parameters:
    • Your Cloud ID - Find the Cloud ID in the Elastic Cloud interface.
    • Base64-encoded API key for Elasticsearch endpoint - Use the Create API key API to create the API key.
    • Type of logs sent via Pub/Sub ... - Add audit.
  6. Click Run Job and wait for Dataflow to execute the template.