Skip to main content

Elastic

Updated

Connect Qevlar to Elasticsearch to investigate Elastic Security detection alerts and pivot through Elastic-indexed endpoint, identity, and network events by running searches. This page lists the permissions Qevlar requires and how to grant them.

Overview

Qevlar authenticates to Elasticsearch's REST API using an API key — no user sign-in per request. You locate your cluster with either a Cloud ID or a Server URL, and authenticate with an API key. Access is governed by the privileges assigned to the key. The connector is read-only: it runs searches to read Detection-Engine alerts and the event indices you want investigated.

API Purpose Auth
Elasticsearch REST API (_search) Read Detection-Engine alerts and run searches over your indices API key

Qevlar reaches your cluster over HTTPS at the Cloud ID or Server URL you provide.

Connection details

Enter these values when configuring the connector in Qevlar. Choose one connection method — Cloud ID or Server URL — then provide an API key.

Field Where to find it Required
Cloud ID Elastic Cloud → Manage this deployment → the Cloud ID shown on the deployment overview Cloud ID method
Server URL Your Elasticsearch endpoint, e.g. https://<deployment>.es.<region>.<csp>.elastic.cloud (Elastic Cloud) or https://<host>:9200 (self-managed) Server URL method
API Key Kibana → Stack Management → API keys → Create API key (copy the encoded key value once) Yes

Provide the Server URL as the full HTTPS endpoint, including the port if it is non-standard. On Elastic Cloud, use Copy endpoint next to Elasticsearch to get the exact URL.

Required permissions

Elasticsearch authorizes through the privileges assigned to the API key (or the role of the account that created it). The key needs a read-only role with:

Requirement Detail
Read on alert indices read index privilege on the Detection-Engine alert indices .alerts-security.alerts-* (space-suffixed, e.g. .alerts-security.alerts-default)
Read on event indices read index privilege on the log/event indices (data views) you want Qevlar to investigate
API key creation The account creating the key needs manage_own_api_key (or manage_api_key)
Network access The Elasticsearch endpoint must be reachable from Qevlar; on Elastic Cloud, add Qevlar's egress IPs to the deployment's traffic filters

A read-only role — the built-in viewer role, or a custom role limited to the indices above — is sufficient. No cluster-management, ingest, or write privileges are required.

Reference: Elasticsearch API keys and Detections privileges.

Setup

  1. Choose or create a role. In Kibana → Stack Management → Roles, use or create a read-only role with read access to .alerts-security.alerts-* and the event indices Qevlar should query. No write privileges are needed.
  2. Create an API key. Kibana → Stack Management → API keys → Create API key. Optionally restrict it with role descriptors matching the read-only privileges above, set an expiry, and copy the encoded key value — it is shown only once.
  3. Get your connection identifier. Copy your Cloud ID (Elastic Cloud → Manage this deployment), or your Elasticsearch endpoint URL (Copy endpoint next to Elasticsearch).
  4. For Elastic Cloud, open access. Add Qevlar's egress IPs to the deployment's traffic filters so the Elasticsearch endpoint is reachable.
  5. Configure the connector. In Qevlar, add the Elasticsearch connector, choose Cloud ID or Server URL, and enter the identifier plus the API key.

Verify the connection

After saving, Qevlar runs a connectivity test. If it fails, check, in order:

  1. The Cloud ID or Server URL is correct and the endpoint is reachable from Qevlar (on Elastic Cloud, confirm the traffic filters). Qevlar surfaces reachability problems on the Server URL field.
  2. The API key is valid and has not expired. Qevlar surfaces authentication problems on the API Key field.
  3. The key's privileges include read access to the target indices (.alerts-security.alerts-* and your event indices).

API reference

Operation HTTP Endpoint
Run search POST {endpoint}/{index}/_search
Fetch Detection-Engine alerts (time window) POST {endpoint}/.alerts-security.alerts-*/_search — paginated with search_after
Fetch a single alert by UUID POST {endpoint}/.alerts-security.alerts-*/_search — filtered on kibana.alert.uuid

Auth header: Authorization: ApiKey <encoded-key>.

Related articles