Search Elasticsearch indices to detect which assets are actively generating security telemetry.
- Elasticsearch 7.x or 8.x (or OpenSearch 1.x/2.x)
- Network access from SilentPulse to the cluster
- API key or basic auth credentials
| Field | Type | Required | Description |
|---|
url | url | yes | Elasticsearch cluster URL |
api_key | password | no | Elasticsearch API key (preferred) |
username | text | no | Basic auth username |
password | password | no | Basic auth password |
skip_tls_verify | boolean | no | Skip TLS certificate verification |
| Field | Type | Required | Default | Description |
|---|
index | text | yes | | Index pattern to search |
query | textarea | no | {"match_all":{}} | Elasticsearch query DSL (JSON) |
hostname_field | text | yes | host.name | Field containing the asset hostname |
time_field | text | no | @timestamp | Timestamp field for time-based filtering |
Also works with OpenSearch clusters using the same API.
| Resource | Request |
|---|
| CPU | 100m |
| Memory | 256Mi |
| Min replicas | 1 |
| Max replicas | 4 |
- Scroll API used for large result sets
- Max 10,000 hits per query by default
