# Integrations & Tools Published articles for Integrations & Tools. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here DevFeed: [Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here]() Original publisher: [Read original article]() Author: Charles Davison Published: 2026-07-29T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [migration](), [SIEM, Security](), [Detection engineering](), [Large Language Model]() Tags: [ai](), [detection](), [integrations-tools](), [llm](), [migration](), [rules](), [security](), [siem]() ### AI overview Elastic introduces an automatic migration path for Microsoft Sentinel detection rules into Elastic Security. The feature translates supported Scheduled and Near Real Time analytics rules, carries over watchlists and severity mappings, and is available in Tech Preview in Elastic 9.5 across multiple cloud providers and regions. ### Source excerpt Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security without rebuilding them. ## From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence DevFeed: [From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence]() Original publisher: [Read original article]() Author: Jamie Hynds,Mia LaVada Published: 2026-06-02T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Security](), [Google](), [API keys](), [VirusTotal](), [agentic workflows](), [telemetry](), [Threat Research](), [ransomware]() Tags: [agentic-workflows](), [api](), [google](), [integrations-tools](), [malware](), [ransomware](), [security](), [telemetry](), [threat-intelligence](), [virustotal]() ### AI overview This tutorial explains how Elastic Security ingests Google Threat Intelligence using an API key and data streams to support continuous detection and historical hunting. It also describes AI-driven workflows that query VirusTotal, enrich alerts, correlate them with telemetry, and summarize findings during investigations. ### Source excerpt Find out how Elastic Security ingests Google Threat Intelligence for continuous detection and uses AI-driven workflows to enrich alerts in real time, from API key to live detections in minutes. ## Monitoring Claude Code/Cowork at scale with OTel in Elastic DevFeed: [Monitoring Claude Code/Cowork at scale with OTel in Elastic]() Original publisher: [Read original article]() Author: Spencer Niemi Published: 2026-04-25T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Monitoring](), [infosec](), [agent observability](), [OpenTelemetry](), [Claude Code](), [Claude](), [elasticsearch](), [Model Context Protocol (MCP)](), [incident](), [Incident response](), [ai-coding](), [Command-line interface]() Tags: [claude-code](), [claude-cowork](), [cli](), [delivery](), [elasticsearch](), [incident-response](), [infosec](), [infrastructure](), [integrations-tools](), [mcp](), [monitoring](), [observability](), [opentelemetry]() ### AI overview Elastic's InfoSec team built a monitoring pipeline for Claude Code and Claude Cowork using native OpenTelemetry exports and Elastic's ingestion infrastructure. The article covers telemetry, gateway deployment, Elasticsearch mappings, ingest pipelines, configuration delivery, and security use cases including threat detection, incident response, and compliance. ### Source excerpt How Elastic's InfoSec team built a monitoring pipeline for Claude Code and Claude Cowork using their native OTel export capabilities and Elastic's OTel ingestion infrastructure. ## Managing Elastic Security Detection Rules with Terraform DevFeed: [Managing Elastic Security Detection Rules with Terraform]() Original publisher: [Read original article]() Author: Kseniia Ignatovych,Omer Kushmaro,Stuart Moorhouse,Marc-Antoine Leclercq Published: 2026-03-13T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Terraform](), [Security](), [Deployment](), [configuration]() Tags: [deploy](), [deployment](), [devops](), [exceptions](), [hcl](), [infrastructure](), [integrations-tools](), [security](), [terraform]() ### AI overview A tutorial on managing Elastic Security detection rules and exceptions as code with the Elastic Stack Terraform Provider. It explains how to define and deploy detection artifacts, compares the provider with the detection-rules repository, and shows how Elastic's AI Agent can help create Terraform configuration. ### Source excerpt Learn to define and deploy Elastic Security detection rules and exceptions using the Elastic Stack Terraform Provider vs detection-rules repository DaC capabilities. ## Manage your Elastic security stack as code with the Elastic Stack Terraform provider DevFeed: [Manage your Elastic security stack as code with the Elastic Stack Terraform provider]() Original publisher: [Read original article]() Author: Omer Kushmaro Published: 2026-02-27T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [terraform provider](), [Infrastructure as code](), [Provisioning](), [Security](), [observability](), [Machine learning](), [Pull Request]() Tags: [audit-trail](), [code-review](), [configuration-drift](), [git](), [hashicorp](), [hcl](), [infrastructure-as-code](), [integrations-tools](), [ml](), [observability](), [security](), [terraform](), [terraform-provider]() ### AI overview Elastic's Terraform provider lets teams manage security detection rules, exception lists, prebuilt rules, machine-learning anomaly detection jobs, synthetics monitors, and AI connectors as version-controlled infrastructure-as-code. This brings these configurations into Git-based, peer-reviewed workflows and helps reduce configuration drift while improving auditability and reproducibility across environments. ### Source excerpt From detection rules to AI connectors - the latest Terraform provider releases bring security, observability, and ML capabilities to your infrastructure-as-code workflows. ## Automating GOAD and Live Malware Labs DevFeed: [Automating GOAD and Live Malware Labs]() Original publisher: [Read original article]() Author: Nic Palmer,Adrian Chen Published: 2026-02-05T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Detection engineering](), [Automation](), [Elastic Cloud](), [Provisioning](), [SIEM, Security](), [active directory](), [workload protection]() Tags: [automate](), [detection](), [detection-engineering](), [elastic-cloud](), [guide](), [how-to](), [infrastructure](), [integrations-tools](), [malware](), [security](), [security-analytics]() ### AI overview A guide to automating a Purple Team range with Ludus and Elastic Security. It explains how to provision instrumented infrastructure, execute attacks, and continuously validate detection rules in a repeatable workflow. ### Source excerpt Stop building labs by hand. Automate the deployment of a fully instrumented Purple Team range using Ludus and Elastic Security. Spin up infrastructure, execute attacks, and validate detection rules in a single, repeatable workflow. ## From Qradar to Elastic: Automate your Detection Rule Migration DevFeed: [From Qradar to Elastic: Automate your Detection Rule Migration]() Original publisher: [Read original article]() Author: Charles Davidson Published: 2026-02-03T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [SIEM, Security](), [SIEM, Security, Observability](), [migration](), [Security](), [XML](), [Network](), [JOIN]() Tags: [announce](), [automate](), [capabilities](), [changes](), [cost](), [custom](), [dashboards](), [infrastructure](), [integrations-tools](), [mapping](), [migration](), [mitre](), [network](), [preview](), [reference](), [running](), [security](), [security-operations](), [siem](), [splunk]() ### AI overview Elastic Security 9.3 introduces Tech Preview support for automatically migrating QRadar detection rules, alongside existing Splunk translation capabilities. The feature translates supported event, flow, and common rules into Elastic-native logic while preserving reference sets, MITRE mappings, and building block rules. ### Source excerpt Today, we are excited to announce a major expansion to our Automatic Migration feature that changes that narrative. In Elastic Security 9.3, we are introducing Automatic Migration support for QRadar detection rules (now in Tech Preview), joining our existing Splunk translation capabilities to further expedite your journey to Elastic Security. Let's take a closer look at what's supported. ## Elastic and Keep join forces to help users manage alerts and automate workflows DevFeed: [Elastic and Keep join forces to help users manage alerts and automate workflows]() Original publisher: [Read original article]() Author: Ken Exner Published: 2025-05-07T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [AIOps](), [workflow automation](), [elasticsearch](), [kibana](), [Open Source](), [observability](), [Security]() Tags: [aiops](), [automation](), [elastic](), [elasticsearch](), [integrations-tools](), [kibana](), [observability](), [open-source](), [security](), [software]() ### AI overview Elastic announces an agreement to acquire Keep Alerting, an open source AIOps company whose platform unifies, deduplicates, correlates, and prioritizes alerts while automating incident remediation. Keep will integrate with Elasticsearch and Kibana and remain open source. ### Source excerpt Elastic announces the acquisition of Keep Alerting ## WinVisor - A hypervisor-based emulator for Windows x64 user-mode executables DevFeed: [WinVisor - A hypervisor-based emulator for Windows x64 user-mode executables]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2025-01-24T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Emulator](), [virtualization](), [Windows](), [API](), [Logging](), [qemu](), [Oracle-VM-VirtualBox]() Tags: [api](), [code](), [cpu](), [emulator](), [hardware](), [implementation](), [integrations-tools](), [logging](), [qemu](), [virtualbox](), [virtualization](), [windows]() ### AI overview WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables. It uses the Windows Hypervisor Platform API to create a virtualized environment for syscall logging and memory introspection, while explicitly leaving comprehensive sandbox security outside the project's scope. ### Source excerpt WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling memory introspection. ## Streamlining Security: Integrating Amazon Bedrock with Elastic DevFeed: [Streamlining Security: Integrating Amazon Bedrock with Elastic]() Original publisher: [Read original article]() Author: Shashank K S Published: 2024-11-14T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Amazon Bedrock](), [Security](), [Security & compliance, Cloud security](), [SIEM, Security](), [Amazon Web Services](), [AI Development]() Tags: [amazon-bedrock](), [aws](), [bedrock](), [cloud-security](), [integration](), [integrations-tools](), [python](), [security](), [security-operations]() ### AI overview A tutorial on integrating Amazon Bedrock with Elastic to improve cloud security monitoring and compliance. It covers setup prerequisites, AWS integration, prebuilt detection rules, misconduct-block detection, and a Python-based exploit test scenario. ### Source excerpt This article will guide you through the process of setting up the Amazon Bedrock integration and enabling Elastic's prebuilt detection rules to streamline your security operations. ## STIXy Situations: ECSaping your threat data DevFeed: [STIXy Situations: ECSaping your threat data]() Original publisher: [Read original article]() Author: Cyril François,Andrew Pease Published: 2024-02-09T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [elasticsearch](), [Security](), [threat detection](), [Temporian](), [Development](), [JSON](), [Structured-data](), [Open Source]() Tags: [data](), [elasticsearch](), [integrations-tools](), [json](), [open-source](), [python](), [script](), [security](), [threat-detection]() ### AI overview Elastic describes a released Python tool that converts STIX 2.x threat-data documents into Elastic Common Schema format for analysis and threat detection in Elasticsearch. The tool can output JSON to standard output, create an NDJSON file, or send data directly to an Elasticsearch cluster. ### Source excerpt Structured threat data is commonly formatted using STIX. To help get this data into Elasticsearch, we're releasing a Python script that converts STIX to an ECS format to be ingested into your stack. ## Streamlining ES|QL Query and Rule Validation: Integrating with GitHub CI DevFeed: [Streamlining ES|QL Query and Rule Validation: Integrating with GitHub CI]() Original publisher: [Read original article]() Author: Mika Ayenson,Eric Forte Published: 2023-11-17T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [ci](), [elasticsearch](), [GitHub](), [Testing](), [kibana](), [Security]() Tags: [ci](), [elastic](), [github](), [integrations-tools](), [kibana](), [security](), [validation]() ### AI overview Elastic Security Labs explains how to validate ES|QL queries and Detection Engine rules using Kibana, Elasticsearch, and GitHub CI. It covers manual validation, syntax and unknown-column errors, field mappings, and warnings versus hard failures. ### Source excerpt ES|QL is Elastic's new piped query language. Taking full advantage of this new feature, Elastic Security Labs walks through how to run validation of ES|QL rules for the Detection Engine. ## Click, Click... Boom! Automating Protections Testing with Detonate DevFeed: [Click, Click... Boom! Automating Protections Testing with Detonate]() Original publisher: [Read original article]() Author: Jessica David,Hez Carty,Sergey Polzunov Published: 2023-05-04T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Testing](), [Security research](), [Security](), [Malware](), [cloud-infrastructure](), [sha256](), [Network Configuration]() Tags: [automate](), [infrastructure](), [integrations-tools](), [malware](), [network-configuration](), [operating-systems](), [security](), [security-research](), [sha256](), [system](), [testing](), [virtual-machine](), [vm]() ### AI overview Elastic Security researchers describe Detonate, an automated system for testing malware protections at scale. It runs potentially malicious software in sandboxed virtual machines, collects execution data, and measures protection efficacy. ### Source excerpt To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion. ## Unpacking ICEDID DevFeed: [Unpacking ICEDID]() Original publisher: [Read original article]() Author: Cyril François Published: 2023-05-04T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Encryption](), [Tutorial](), [Cryptography](), [Python]() Tags: [algorithms](), [encryption](), [integrations-tools](), [library](), [malware](), [python](), [python-3-10](), [repository](), [security](), [tutorial]() ### AI overview This tutorial explains how to unpack ICEDID malware that uses custom file formats and encryption. It introduces Elastic Security Labs tools, including the nightMARE module, and demonstrates analysis of a fake GZip sample in a controlled Windows and Python environment. ### Source excerpt ICEDID is known to pack its payloads using custom file formats and a custom encryption scheme. We are releasing a set of tools to automate the unpacking process and help analysts and the community respond to ICEDID. ## Ingesting threat data with the Threat Intel Filebeat module DevFeed: [Ingesting threat data with the Threat Intel Filebeat module]() Original publisher: [Read original article]() Author: Andrew Pease,Marius Iversen Published: 2023-03-01T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Threat Research](), [elasticsearch](), [SIEM, Security, Observability](), [kibana]() Tags: [configuration](), [elasticsearch](), [integrations-tools](), [kibana](), [research](), [security](), [threat-intel](), [threat-intelligence]() ### AI overview A tutorial on using the Threat Intel Filebeat module to ingest open-source threat intelligence feeds into the Elastic Stack. It explains how the module loads data into Elasticsearch, normalizes it into the Threat ECS fieldset, and supports analysis through Kibana dashboards and visualizations. ### Source excerpt Tutorial that walks through setting up Filebeat to push threat intelligence feeds into your Elastic Stack. ## The Elastic Container Project for Security Research DevFeed: [The Elastic Container Project for Security Research]() Original publisher: [Read original article]() Author: Andrew Pease,Colson Wilhoit,Derek Ditch Published: 2023-03-01T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Security research](), [Docker](), [elasticsearch](), [kibana](), [Shell](), [Deployment](), [Testing](), [Open Source](), [Monitoring]() Tags: [container](), [deployment](), [docker](), [elastic](), [elasticsearch](), [integrations-tools](), [kibana](), [malware](), [monitoring](), [open-source](), [ransomware](), [research](), [script](), [security](), [security-research](), [shell](), [testing]() ### AI overview A tutorial introduces the Elastic Container Project, a shell script that deploys and manages a local, TLS-secured Elastic Stack with Docker for testing and security research. It covers the stack's components, project usage, and Kibana-based security workflows. ### Source excerpt The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases. ## NETWIRE Dynamic Configuration Extraction DevFeed: [NETWIRE Dynamic Configuration Extraction]() Original publisher: [Read original article]() Author: Seth Goodwin,Salim Bitam Published: 2023-01-30T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Encryption](), [Tool](), [Assembly](), [Code](), [.env]() Tags: [assembly](), [decrypt](), [encryption](), [integrations-tools](), [malware](), [rat](), [reversing](), [security](), [security-labs](), [tool](), [trojan](), [yara]() ### AI overview Elastic Security Labs examines the NETWIRE remote access trojan and releases a tool for dynamically extracting its encrypted configuration from files and memory dumps. The article describes the malware's RC4-protected configuration, relevant functions and assembly patterns, and YARA rules for locating keys and encrypted values. ### Source excerpt Elastic Security Labs discusses the NETWIRE trojan and is releasing a tool to dynamically extract configuration files. ## NETWIRE Configuration Extractor DevFeed: [NETWIRE Configuration Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2023-01-27T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Python](), [Script](), [Docker](), [C2](), [Poetry](), [Encryption](), [payload]() Tags: [c2](), [docker](), [encryption](), [integrations-tools](), [malware](), [payload](), [poetry](), [python](), [script]() ### AI overview A Python-based NETWIRE configuration extractor analyzes malware samples and can extract encryption keys, command-and-control information, wide-character strings, and ASCII strings. The project supports Docker-based execution and local setup with Poetry. ### Source excerpt Python script to extract the configuration from NETWIRE samples. ## BPFDoor Configuration Extractor DevFeed: [BPFDoor Configuration Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Docker](), [Docker Container](), [Python](), [Command-line interface](), [Poetry](), [passwords]() Tags: [command-line](), [docker](), [docker-container](), [integrations-tools](), [malware](), [passwords](), [poetry](), [python](), [security]() ### AI overview A Python module and command-line tool extracts hardcoded passwords from BPFDoor malware samples. The document explains how to run the extractor with Docker or locally using Poetry, including support for scanning individual samples or directories. ### Source excerpt Configuration extractor to dump out hardcoded passwords with BPFDoor. ## ICEDID Configuration Extractor DevFeed: [ICEDID Configuration Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Python](), [Docker](), [Script](), [Docker Container](), [Poetry](), [payload](), [execution]() Tags: [docker](), [docker-container](), [execution](), [integrations-tools](), [malware](), [payload](), [poetry](), [python](), [script]() ### AI overview A Python-based configuration extractor for ICEDID malware samples. The project can be run in Docker or locally with Poetry, accepts individual samples or directories, and collects extracted configurations. ### Source excerpt Python script to extract the configuration from ICEDID samples. ## QBOT Configuration Extractor DevFeed: [QBOT Configuration Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Python](), [Malware](), [Script](), [Docker](), [Docker Container](), [Command-line interface](), [Poetry](), [Threat Research]() Tags: [command-line](), [docker](), [docker-container](), [integrations-tools](), [malware](), [malware-analysis](), [poetry](), [python](), [script]() ### AI overview A Python module and command-line tool extracts configurations from QBOT malware samples. The document explains running it with Docker or locally using Poetry. ### Source excerpt Python script to extract the configuration from QBOT samples. ## PARALLAX Payload Extractor DevFeed: [PARALLAX Payload Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Python](), [Script](), [Docker](), [Malware](), [Docker Container](), [Poetry]() Tags: [docker](), [docker-container](), [integrations-tools](), [malware](), [payload](), [poetry](), [python](), [script]() ### AI overview A guide to using a Python script to extract payloads from PARALLAX malware samples. It explains running the extractor in Docker or locally with Poetry, including options for processing individual samples or directories and selecting an output directory. ### Source excerpt Python script to extract the payload from PARALLAX samples. ## BPFDoor Scanner DevFeed: [BPFDoor Scanner]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Python](), [Security](), [Docker](), [Poetry](), [Testing]() Tags: [docker](), [integrations-tools](), [malware](), [poetry](), [python](), [scanner](), [security](), [testing](), [udp]() ### AI overview A practical guide to using a Python-based scanner to identify hosts infected with BPFDoor malware. It covers required Linux permissions, Docker execution, UDP port configuration, and running the tool locally with Poetry. ### Source excerpt Python script to identify hosts infected with the BPFDoor malware. ## EMOTET Configuration Extractor DevFeed: [EMOTET Configuration Extractor]() Original publisher: [Read original article]() Author: Elastic Security Labs Published: 2022-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Python](), [C2](), [Docker](), [Cryptography](), [Poetry](), [Hackathon-Kit]() Tags: [c2](), [docker](), [encryption](), [integrations-tools](), [malware](), [poetry](), [python]() ### AI overview This guide presents a Python-based extractor for retrieving configuration data from EMOTET malware samples. It explains how to run the tool in Docker or locally with Poetry, and describes options for extracting encryption keys, C2 information, wide-character strings, and ASCII strings. ### Source excerpt Python script to extract the configuration from EMOTET samples. [Next page]()