Elastibot Documentation¶

Elastibot is a Slack bot (Node.js / Bolt) that lets security analysts turn Elastic alerts into Kibana cases without leaving Slack, and pushes new alerts and cases into the channels they're supposed to land in.

They're are two main components: the watchers poll Elastic on a timer and post what they find(alerts). The commands are what an analyst runs or clicks in response. They both use the incident store, which is the thing that keeps a Slack message and a Kibana case agreeing with each other.

Table of Contents¶

• Getting Started
  • Installation
  • Elastic API Keys
• Using Elastibot
  • Slash Commands
  • Incident Messages
• How It Works
  • Architecture
  • The Watchers
  • Alert Grouping
  • Incidents
  • Cases
  • Storage
• Reference
  • Configuration
  • Logging and Errors
• Developer Guide

Quick reference¶

Command	What it does
/start [kibana_username]	Register your Elastic API key so cases are attributed to you
/case <alertID>	Create a case for an alert and attach it
/add_alert <caseID> <alertID>	Attach an alert to a case that already exists
/stats [window] [filters] [share]	Aggregate view of the alerts index