Skip to content
Try the API
Try the API

Integrations

Elastio integrates with the tools your security team already uses. Some integrations send Elastio events out (Slack, Splunk, webhooks), some enrich Elastio data (VirusTotal), and some bring partner alerts in so Elastio can start a hunt or an investigation on the affected asset (Wiz, Amazon GuardDuty). Each one is managed through the /gateway/integration/… or /gateway/ingestion/… services of the Elastio API.

Partner integrations

Section titled “Partner integrations”
SlackConnect a workspace with OAuth, map channels, send test messages and track deliveries.
SplunkMonitor delivery of Elastio events to Splunk HTTP Event Collector.
VirusTotalStore a VirusTotal API key and look up file reports by hash.
WizReceive Wiz alerts and asset events and let Elastio start hunts on the affected assets.
Amazon GuardDutyRoute GuardDuty findings from your AWS accounts to Elastio so it can hunt on the affected assets.

Alerts and webhooks

Section titled “Alerts and webhooks”

Alerts decide which Elastio events notify someone; webhooks deliver those events to any HTTPS endpoint you run.

AlertsCreate alert rules and choose where notifications go.
WebhooksSend Elastio events to your own systems and track deliveries.

Before you start

Section titled “Before you start”
  • You need a personal access token for your tenant. If the token is scoped, make sure its grants cover the operations you call; tokens can be scoped to categories including integrations.
  • Some write operations are restricted to tenant admins. The Slack operations, for example, say “Admin only” in their descriptions.
  • The Wiz inbound endpoint is different: Wiz calls it with a separate integration token, not a personal access token. See Wiz.

Every integration operation is also in the API reference under Alerts & Integrations.