Integration Name
Keeper Security [packages/keeper_security_siem_integration]
Dataset Name
No response
Integration Version
0.2.0
Agent Version
9.3.1
OS Version and Architecture
k8s self-deployment
User Goal
What we need is the opposite direction: Elastic Agent polls the Keeper cloud
over HTTPS and pulls the events in. Keeper already supports this through
the ARAM events endpoint (GET /api/rest/public/events, authenticated with
x-api-token, paginated with continuation_token), so nothing is needed on
Keeper's side — it's just not exposed as an input in the package today.
Settings the integration should expose:
- Keeper URL — the API endpoint to connect to, since it differs per region
(keepersecurity.com, keepersecurity.eu, and so on)
- API Token — generated in the Keeper admin portal / Commander with SIEM read
access, stored as a secret
- Initial interval — how far back the first run collects, e.g. 24h
- Interval — how often to poll, e.g. 15m
- Preserve original event — plus the usual tags, proxy, timeout and processor
settings other API-based integrations have
The events returned by the API are the same ones the push path already sends,
so the existing ingest pipeline and dashboard should work as they are.
Existing Features
Right now the Keeper integration only works one way: Keeper's cloud pushes
audit events into Elasticsearch through the bulk API. That means the
Elasticsearch endpoint has to be reachable from the internet, which isn't an
option for us — we run the stack on-prem and won't open it inbound just for
this. Same reason we don't want Keeper's syslog forwarding.
What did you see?
No user input option on the elastic keeper integration.
Anything else?
No response
Integration Name
Keeper Security [packages/keeper_security_siem_integration]
Dataset Name
No response
Integration Version
0.2.0
Agent Version
9.3.1
OS Version and Architecture
k8s self-deployment
User Goal
What we need is the opposite direction: Elastic Agent polls the Keeper cloud
over HTTPS and pulls the events in. Keeper already supports this through
the ARAM events endpoint (GET /api/rest/public/events, authenticated with
x-api-token, paginated with continuation_token), so nothing is needed on
Keeper's side — it's just not exposed as an input in the package today.
Settings the integration should expose:
(keepersecurity.com, keepersecurity.eu, and so on)
access, stored as a secret
settings other API-based integrations have
The events returned by the API are the same ones the push path already sends,
so the existing ingest pipeline and dashboard should work as they are.
Existing Features
Right now the Keeper integration only works one way: Keeper's cloud pushes
audit events into Elasticsearch through the bulk API. That means the
Elasticsearch endpoint has to be reachable from the internet, which isn't an
option for us — we run the stack on-prem and won't open it inbound just for
this. Same reason we don't want Keeper's syslog forwarding.
What did you see?
No user input option on the elastic keeper integration.
Anything else?
No response