In modern cybersecurity, organizations must be prepared to handle a wide variety of threat intelligence data to stay ahead of emerging threats. To support this need, Elastic introduces theCustom Threat Intelligence integration, specifically designed for ingesting indicators of compromise (IoCs) in the STIX 2.1 format. By converting STIX data into the Elastic Common Schema (ECS), this integration makes it simple to bring threat data from diverse sources directly into Elastic for unified analysis and detection workflows.

This integration gives users the flexibility to gather threat intelligence from a range of sources, such as STIX-compliant APIs, TAXII 2.1 servers, and even log files in air-gapped environments.

Key features of the Custom Threat Intelligence integration

The Custom Threat Intelligence integration is built for ingesting and converting STIX data into ECS, allowing users to merge threat intelligence from various external sources into Elastic effortlessly. Below are the integration’s core features:

**Conversion of STIX indicators to ECS:** The integration is designed to ingest STIX 2.1 format data, converting each indicator into ECS-compatible fields. A default pipeline handles common STIX data mappings automatically, but users can extend functionality by adding custom pipelines for unique STIX indicators or formats as needed.

**CEL input for API communication:** The integration uses the Common Expression Language (CEL) input to enable flexible communication with STIX APIs. Through CEL programs, the integration can connect to STIX-compliant APIs and retrieve relevant threat intelligence data. This approach allows for highly customizable data ingestion, handling HTTP requests, responses, and data processing in a structured way.

**Built-in TAXII 2.1 client for simplified data retrieval:** For organizations relying on TAXII servers, the integration includes a built-in CEL program that acts as a TAXII 2.1 client. This client facilitates connections to TAXII 2.x servers, automatically retrieving STIX data with minimal configuration — just the TAXII server URL and any required authentication credentials.

**Log file support for air-gapped environments:** Recognizing the needs for air-gapped environments, the integration also supports reading STIX-based threat intelligence from log files. This enables organizations in isolated environments to incorporate threat intelligence without requiring direct internet access.

**Built-in dashboard for visualizing indicators:** The integration comes with a built-in dashboard to visualize ingested threat intelligence indicators, making it easy for users to view and interpret the threat data collected. This dashboard provides an organized view of indicators, helping analysts quickly assess threat intelligence patterns and enhance awareness.

Custom Threat Intelligence dashboard: IoCs overview

Use case: Understanding a CEL program for custom API ingestion

For STIX APIs that do not follow a specific protocol like TAXII, CEL programs allow you to customize the retrieval and processing of threat data. Using CEL, you can define HTTP headers, query parameters, pagination, and payload processing to meet the requirements of the API — ensuring accurate and complete ingestion of threat intelligence.

To show how CEL programs work within the Custom Threat Intelligence integration, let’s break down a sample CEL program. This example shows how a CEL program can be used to retrieve data from a custom STIX API using the GET method and incorporates flexible authentication options based on the presence of an API key or Basic Authentication credentials.

state.with(
  request(
    "GET",
    (has(state.initial_interval) && state.initial_interval != "") ?
      (
        state.url.trim_right("/") + "?" + {
          "start": [(now() - duration(state.initial_interval)).format(time_layout.RFC3339)],
        }.format_query()
      )
    :
      state.url
  ).with(
    {
      "Header": {
        "Authorization": (has(state.api_key) && state.api_key != "") ?
          ["Bearer " + string(state.api_key)]
        : (state.?username.orValue("") != "" && state.?password.orValue("") != "") ?
          ["Basic " + (state.username + ":" + state.password).base64()]
        :
          []
      }
    }
  ).do_request().as(resp, (resp.StatusCode == 200) ?
    bytes(resp.Body).decode_json().as(body,
      {
        "events": body.objects.map(e,
          {
            "message": e.encode_json(),
          }
        ),
        "url": state.url,
        "api_key": state.?api_key.orValue(""),
        "username": state.?username.orValue(""),
        "password": state.?password.orValue(""),
      }
    )
  :
    {
      "events": {
        "error": {
          "code": string(resp.StatusCode),
          "id": string(resp.Status),
          "message": "GET:" +
          (
            (size(resp.Body) != 0) ?
              string(resp.Body)
            :
              string(resp.Status) + " (" + string(resp.StatusCode) + ")"
          ),
        },
      }
    }
  )
)

!Image 21Copy to clipboard Copy to clipboard

Breaking down the CEL program

1. **Request construction:** The CEL program constructs an HTTP GET request. If the _initial\_interval_ is set, the request URL appends a query parameter specifying the start time — which is calculated from the current time minus the initial interval. This allows the integration to fetch only recent threat data.

2. **Header setup:** The program dynamically builds the Authorization header to support different types of authentication:

1. If an _api\_key_ is provided, it creates a Bearer token using _Authorization: Bearer <api\_key>_.

2. If the API requires Basic Authentication instead, it checks for _username_ and _password_ fields, encoding them in base64 as required by the Basic <encoded_credentials> format.

3. If neither an API key nor username and password are available, the Authorization header is left empty.

3. **Data processing on successful response:** If the response status is 200 (OK), the program decodes the JSON body of the response and maps each STIX object as an event in Elastic.

4. **Error handling:** If the response status is not 200, the program generates an error event that includes the status code, response status, and any response body content. This error handling provides visibility into any issues with data retrieval.

CEL initial state

Each CEL program requires an initial state definition — which includes key parameters, such as the API URL, authentication tokens, and retrieval intervals. Following the example above, the CEL state for this case could look like this.

url: "https://stix-server.example.com"
username: "<USERNAME>"
password: "<PASSWORD>"
initial_interval: "120h"

!Image 22Copy to clipboard Copy to clipboard

When adding a CEL program to the Custom Threat Intelligence integration, ensure the _Enable TAXII 2.1_ toggle is disabled, and paste the CEL program and its initial state into the designated blocks in the integration’s configuration.

CEL configuration for the integration

This example provides a generic template for using CEL programs to retrieve threat intelligence from STIX APIs. However, users will likely need to adapt the program based on the specific requirements of their STIX server — paying particular attention to query parameters, required headers, and the structure of the response body.

Bring threat data into your security infrastructure easily

Elastic’s Custom Threat Intelligence integration makes it easy to bring threat data into your security infrastructure — giving you more insights to catch and respond to threats faster. With support for STIX 2.1 indicators, connections to TAXII servers, and flexible CEL configurations, this integration is built to fit your specific needs — turning threat intelligence indicators into ECS format so that it works seamlessly across the Elasticsearch Platform.

We’re excited for you totry out these features, explore new use cases, and share your feedback to help us continue evolving threat intelligence capabilities within Elastic.

_The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all._

![Image 24: Twitter!Image 25: TwitterShare on Twitter](javascript:void(0))Share on Twitter
![Image 26: LinkedIn!Image 27: LinkedInShare on LinkedIn](javascript:void(0))Share on LinkedIn
![Image 28: Facebook!Image 29: FacebookShare on Facebook](javascript:void(0))Share on Facebook
![Image 30: email!Image 31: emailShare by Email](javascript:void(0))Share by Email
![Image 32: print!Image 33: printPrint this page](javascript:void(0))Print

Sign up for Elastic Cloud free trial

Spin up a fully loaded deployment on the cloud provider you choose. As the company behind Elasticsearch, we bring our features and support to your Elastic clusters in the cloud.

Start free trial

![Image 34: Elastic The Search AI Company](http://www.elastic.co/)

![Image 35: Elastic's LinkedIn page](https://www.linkedin.com/company/elastic-co)
![Image 36: Elastic's YouTube page](https://www.youtube.com/user/elasticsearch)
![Image 37: Elastic's Facebook page](https://www.facebook.com/elastic.co)
![Image 38: Elastic's Twitter page](https://www.twitter.com/elastic)
![Image 39: Elastic's GitHub page](https://github.com/elastic)

About us About Elastic Leadership Blog Newsroom
Join us Careers Career portal How we hire

Partners Find a partner Partner login Request access Become a partner
Trust & Security Legal Trust center Privacy Trade Compliance Ethics & Compliance

Investor relations Investor resources Governance Financials Stock
Excellence Awards Previous winners Elastic{ON} Tour Become a sponsor All events

About us

Join us

Partners

Trust & Security

Investor relations

Excellence Awards

This website and all associated content, software, discussion forums, products, and services are intended for professional use only. No consumer use of this website or its content is intended or directed.

Elastic, Elasticsearch, and other related marks are trademarks, logos, or registered trademarks of elasticsearch B.V. in the United States and other countries.

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries. All other brand names, product names, or trademarks belong to their respective owners.

!Image 41!Image 42!Image 43

![Image 45](blob:https://www.elastic.co/a5d9790f-21a6-48b2-ba3c-40f01fb7b6af)

问问这篇内容

回答仅基于本篇材料

Skill 包

领域模板，一键产出结构化笔记

论文精读包
把一篇论文 / 技术博客精读成结构化笔记：问题、方法、实验、批判、延伸阅读。
- · TL;DR（1 段）
- · 研究问题与动机
- · 方法概览
投融资雷达包
把一条融资 / 创投新闻整理成投资人视角的雷达卡：交易要点、判断、竞争格局、风险、尽调清单。
- · 交易要点（公司 / 轮次 / 金额 / 投资人 / 估值，材料未明示则写 “未披露”）
- · 投资 thesis（这家公司为什么值得关注）
- · 竞争格局与替代方案

导出到第二大脑

支持 Notion / Obsidian / Readwise

下载 Markdown（Obsidian 直接拖入）

Elastic’s new Custom Threat Intelligence integration