Integration · SIEMs
Elastic Security
Reads Elastic Security alerts into cases, and can write Kandaro’s findings to a data stream.
What Kandaro does with it
Kandaro SOC and Elastic Security.
Where your alerts already land. Kandaro reads them, opens cases and investigates.
- Alerts in
Reads its alerts and groups them into cases with fixed rules.
- Research
Searches it for related activity while it investigates a case. This uses Kandaro Connect.
- Alerts out
Sends new incidents and cases to it.
How it connects
Pick the way that fits.
- Cloud API
Kandaro reads from the vendor’s cloud. Nothing to install.
- Quick push
Your tool sends each alert to a private Kandaro address.
- Kandaro Connect
A small container on your network that only connects out. Adds research and response.
- Vendor API
Kandaro calls the vendor’s API with the access you grant.
What Kandaro needs
What you set up once.
- Elastic Cloud: an API key that may read alerts.
- Self-managed: a push from your rules, or Kandaro Connect.
SIEMs
More tools like this.
Wazuh
Reads every Wazuh alert into cases, and blocks addresses or isolates Linux machines through Wazuh’s own responses.
- Alerts in
- Research
- Respond
- Quick push
- Kandaro Connect
Splunk
Reads notable events or a saved search into cases, and can send Kandaro’s findings back to Splunk.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Microsoft Sentinel
Reads Sentinel incidents and alerts into cases, and can write Kandaro’s findings to a Sentinel workspace.
- Alerts in
- Alerts out
- Cloud API
- Vendor API
Connect Elastic Security to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing