SOAR

Elastic workflow for Easy Intel

Here is an Elastic workflow that can be used to seamlessly ingest threat intelligence from our easy intel product into Elastic SIEM. If you haven’t heard of Elastic workflows yet, you should certainly check it out, it provides a way to automate common security tasks using simple primitives, right within Elastic SIEM. If you’re on Elastic 9.4+, you should be able to copypasta this into a workflow (keep in mind there will be data ingest costs if you are on serverless - you use this workflow and easy intel at your own risk).