This guide outlines the general steps for creating an Elastic account and enabling Elastic Security (SIEM). You can follow these steps to set up your environment for the Spikerz SIEM integration.1. Start with Elastic Cloud
The simplest way to begin is by using Elastic Cloud, which offers a free trial and manages the infrastructure for you.
Visit the Elastic Website: Go to the official Elastic website
Sign Up: You will be prompted to sign up using your email, Google, or GitHub account.
Create/Host Your Deployment
Configure Elastic Security (SIEM)
Once your Elastic Cloud deployment is active, you can access Kibana and enable the Security application.
Launch Kibana: Click the "Launch" button on your deployment page to open the Kibana web interface.
Navigate to Security: In Kibana, use the navigation menu (usually on the left side) and find the Security application. This is where the SIEM functionality resides.
Create an index
Open Kibana → Stack Management → Index Management
Click “Create Index” (or “Create Index Pattern” depending on version)
Enter a name, for example:
siem-alerts
In case the Index Management is not visible in Kibana Stack Management, go to the Dev Tools section and create the index from there using the PUT command:
PUT siem-alerts
{
"mappings": {
"properties": {
"accountId": { "type": "text" },
"platform": { "type": "text" },
"timestamp": { "type": "date" },
"type": { "type": "keyword" }
}
}
}
Integration with Spikerz SIEM
To integrate your new Elastic environment with Spikerz, you will first need to create an User API key from the API keys section:
To generate the connection URL we would need to get the Elastic endpoint:
Open Kibana → Security → Add Integration (or navigate to the URL path /app/integrations/browse/security)
Open Connect details dialog and copy Elasticsearch endpoint
Your SIEM Spikers connection URL should consist of the Elasticsearch endpoint, index name and doc API reference:
https://<your Elasticsearch endpoint>/siem-alert/_doc
Navigate to your Spikerz profile and tap on the "Settings" button.
Go to the Settings section and tap on "Workspace". In this screen tap on the "Connect SIEM" button.
Choose the Elastic provider and enter the Elastic connection URL and API key and click the ”Test SIEM alerts” button. Once you get successful notification your connection is ready to be used.