{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44242,"path":"security-management/security-incident-response/activate-configure-elasticsearch.md","title":"Get started with the Elasticsearch - Incident Enrichment integration","bundle":null,"doc_type":null,"release":"australia","body":"\n# Get started with the Elasticsearch - Incident Enrichment integration\n\nElasticsearch is a distributed, RESTful search and analytics engine that easily integrates with Security Operations. Before you can use the Elasticsearch - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate API Base URL and login credentials.\n\n## Before you begin\n\nRole required: sn\\_si.admin\n\n## Procedure\n\n1.  [Download the integration from the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/download-app-first-time.md).\n\n2.  When the installation is complete, access Elasticsearch and obtain the API Base URL under your Elasticsearch profile.\n\n3.  In your instance, navigate to **Security Operations** > **Integrations** > **Integration Configurations**.\n\n    The available security integrations appear as a series of cards.\n\n4.  In the Elasticsearch - Incident Enrichment card, select **New**.\n\n5.  Fill in the fields, as needed.\n\n    |Field|Description|\n    |-----|-----------|\n    |Name|The name of this configuration.|\n    |Elasticsearch API Base URL|The base URL you acquired from the Elasticsearch site.|\n    |Link URL|\\[Optional\\] Links to a Kibana instance, when available|\n    |Username|Your Intel Elasticsearch username.|\n    |Password|Your Intel Elasticsearch password.|\n    |Max Rows|The maximum number of rows you want to search.|\n    |Earliest Result \\(days\\)|The earliest results you want to see in number of days.|\n    |Include raw data samples in search results|Select this to include samples of raw data in your sightings search results. The amount of data returned depends on your setting in the **number of rows of raw data** property in [Security Incident Response properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/installed-with-sir.md).|\n    |MID Server|Select **Any** to use any active MID Server, or select a specific MID Server name.|\n\n    **Note:** Configuring this integration activates workflows. To manage the workflows, navigate to the **Workflow Editor**.\n\n6.  Select **Submit**.\n\n    The integration configuration card displays.\n\n7.  When viewing the new configuration card, you can select **Configure** or **Delete** to change or delete the configuration, respectively.\n\n8.  To return to the original list of integration configuration cards, select **No** from the **Show Configurations** drop-down list.\n\n\n## Result\n\nAfter it is configured, the Elasticsearch - Incident Enrichment integration can be selected for publishing observables to watchlists in Security Incident Response.\n\n**Parent Topic:**[Elasticsearch Incident Enrichment integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/elasticsearch-landing-page.md)\n\n"}}