Elastic SIEM real-time ingestion
Streams events from Elasticsearch using Point-in-Time and search_after.
Status
Configurable
Built and ready. Bring your own keys, models or connected systems and it works; without them it stays idle.
Good to know
No automated test in this repository. Needs an Elastic deployment.
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.