---
title: Elasticsearch alert integration
description: This article explains how to implement an Elasticsearch alert integration using Cydarm’s actuator webhook receiver.
---

[Skip to content](https://support.cydarm.com/en/knowledge/elasticsearch-alert-integration#main-content)

English

Show submenu for translations

[More support](https://support.cydarm.com/en/knowledge/kb-tickets/new?hsLang=en) [Customer portal](https://support.cydarm.com/tickets-view?hsLang=en)

![Cydarm Logo](https://support.cydarm.com/hs-fs/hubfs/cydarm%202024%20logo%20blue%20on%20transparent%201000x250%20(3).png?width=200&height=50&name=cydarm%202024%20logo%20blue%20on%20transparent%201000x250%20(3).png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [More support](https://support.cydarm.com/en/knowledge/kb-tickets/new)
- [Customer portal](https://support.cydarm.com/tickets-view)
- Contact us

 Contact us

 How can we help you?

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.cydarm.com/en/knowledge?hsLang=en)
2. [Cydarm Administration](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en)
3. [Integrations](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#integrations)

# Elasticsearch alert integration

## This article explains how to set up the Elasticsearch alert integration using Cydarm’s webhook receiver.

### Overview

For the Elasticsearch alert integration to work using Cydarm’s webhook receiver, you will need to have a Gold tier license for Elastic Cloud.

### Steps to set up the integration

#### 1. Create a Webhook Connector in Cydarm

1. Go to **Settings → Advanced Connectors**
2. Click **Create connector** → Select connector type **Webhook Endpoint**
3. Configure:
   
     - **Name:** Your webhook name
     - **Description:** Your description
     - **Webhook URL:** Your endpoint URL (autogenerated - copy this)
     - **Data Format:** JSON
     - **Case Description Template:** 
       
       `{{data.rule_name}} ({{data.alert_count}})` 
4. Save the connector

#### 2. Add Action to Detection Rule in Elastic

1. Go to **Security → Rules**
2. Edit your rule → **Actions** tab
3. Create a webhook connector:
   
     - **Name:** Cydarm
     - **Method:** POST
     - **Webhook URL:** use the one from Cydarm in step 1
     - **Authentication:** none
     - **Add HTTP header:**
       
           - Content-Type: application/json
4. Set **Action frequency:**
   
     - *Summary of alerts* - batched notifications at intervals
     - *For each alert* - immediate per-alert notifications

#### 3. Configure the Webhook Body in Elastic

Use this template with `ParseHjson` to ensure valid JSON output: 

`{{#ParseHjson}}`  
`{`  
`  "alerts": [`  
`    {{#context.alerts}}`  
`    {`  
`      "id": "{{{_id}}}",`  
`      "timestamp": "{{{@timestamp}}}",`  
`      "severity": "{{{kibana.alert.severity}}}",`  
`      "risk_score": {{{kibana.alert.risk_score}}},`  
`      "status": "{{{kibana.alert.workflow_status}}}",`  
`      "rule": {`  
`        "name": "{{{kibana.alert.rule.name}}}",`  
`        "id": "{{{kibana.alert.rule.uuid}}}",`  
`        "description": "{{{kibana.alert.rule.description}}}",`  
`        "category": "{{{kibana.alert.rule.category}}}"`  
`      },`  
`      "reason": "{{{kibana.alert.reason}}}",`  
`      "source": {`  
`        "host": "{{{agent.name}}}",`  
`        "cloud_provider": "{{{cloud.provider}}}",`  
`        "region": "{{{cloud.region}}}",`  
`        "instance_id": "{{{cloud.instance.id}}}"`  
`      },`  
`      "original_event_time": "{{{kibana.alert.original_time}}}",`  
`      "alert_url": "{{{kibana.alert.url}}}"`  
`    }{{^last}},{{/last}}`  
`    {{/context.alerts}}`  
`  ],`  
`  "rule_name": "{{{rule.name}}}",`  
`  "alert_count": "{{{context.alerts.length}}}",`  
`  "execution_time": "{{{date}}}"`  
`}`  
`{{/ParseHjson}} `

 

- [General](https://support.cydarm.com/en/knowledge/general?hsLang=en#main-content)

    - [User Guides](https://support.cydarm.com/en/knowledge/general?hsLang=en#user-guides)
    - [Updates & Release Notes](https://support.cydarm.com/en/knowledge/general?hsLang=en#updates-release-notes)
    - [Playbooks](https://support.cydarm.com/en/knowledge/general?hsLang=en#playbooks)
- [Cydarm Administration](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#main-content)

    - [Authentication](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#authentication)
    - [Application Administration](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#application-administration)
    - [Integrations](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#integrations)
    - [API](https://support.cydarm.com/en/knowledge/cydarm-administration?hsLang=en#api)

[![Cydarm Logo](https://support.cydarm.com/hs-fs/hubfs/cydarm%202024%20logo%20blue%20on%20transparent%201000x250%20(3).png?width=200&height=50&name=cydarm%202024%20logo%20blue%20on%20transparent%201000x250%20(3).png "Cydarm Logo")](http://cydarm.com)

<https://www.facebook.com/> <https://www.twitter.com/> <https://www.instagram.com/> <https://podcasts.apple.com/> [mailto:email@email.com](mailto:email@email.com)

Copyright © 2026, Cydarm Technologies