You can configure the Cequence Unified API Protection (UAP) platform to export data to an Elasticsearch instance.

Configuring Elasticsearch

Configure Elasticsearch to export data from the Cequence UAP platform.

Deploy or access an Elasticsearch cluster

Set up an Elasticsearch cluster to receive exported data. You can use a managed service or deploy Elasticsearch on your own infrastructure.

1. For a managed service, use Elastic Cloud, Amazon OpenSearch Service, or another cloud provider's managed offering.
2. For self-hosted deployment, see the Elasticsearch installation documentation.
3. Note the endpoint URL and port for your cluster (typically port 9200).

Create an index

Create an Elasticsearch index to store exported data.

1. Access your Elasticsearch management interface (Kibana, Elastic Cloud Console, or the API).
2. Select Index Management and select Create index.
3. Enter an Index name (for example, cequence-uap-exports).
4. Configure index settings and mappings or accept the defaults.
5. Select Create.

Create a user and configure permissions

Create credentials that enable Cequence UAP to write data to your index.

For a managed Elasticsearch service:

1. Navigate to the service's security section (for example, Elastic Cloud Security Users).
2. Create a new user or modify an existing one.
3. Assign a role such as index_write or manage_index for your target index.
4. Note the username and password.

For self-hosted Elasticsearch with X-Pack Security:

1. Use Kibana or the elasticsearch-users CLI tool to create a user.
2. Assign appropriate roles for your index.
3. Note the username and password.

Optional: Configure network access

Ensure your Elasticsearch cluster is reachable from the Cequence UAP environment. Update firewall rules or security groups to allow inbound connections on the Elasticsearch port (default 9200). Restrict access to trusted IP addresses or networks.

Optional: Enable HTTPS

For encrypted data transfer, enable HTTPS on your Elasticsearch cluster. Install a valid SSL/TLS certificate or use your managed service's built-in encryption. Ensure the certificate is trusted by the Cequence UAP environment.

Test the connection

Verify that your user credentials and network access work correctly. Run the following command from an environment that can reach your Elasticsearch cluster.

curl -u username:password -X POST "https://elasticsearch-endpoint/index-name/_doc" -H "Content-Type: application/json" -d '{"test":"connection"}'

Replace username, password, elasticsearch-endpoint, and index-name with your actual values. A successful response indicates that the connection works and documents can be written to your index.

Configuring the Cequence UAP platform

Once you've prepared Elasticsearch, finish configuring the data export integration from the Cequence UAP platform dashboard.

1. Log in to the Cequence UAP platform.
2. From the left navigation bar, select Integrations > Data Export.
3. In the Add a new integration section, choose a type from the Select a type drop-down.
   The new data export dialog appears with the Overview tab selected.
4. In the Overview tab, type the following information.
   • Integration name
   • Host Address
   • Index Name
   • Index User
   • Index Password
   • Use HTTPS: activate this toggle to use HTTPS.
5. Determine which event types you want to export. The following event types are available.
   • Risk events
   • Bot detection events
   • Bot mitigation events
   • Audit log events
6. For each event type you're exporting, click the corresponding tab, then perform the "Defining event criteria and export fields" procedure following this procedure.
7. Verify that the Enable Integration toggle is on. Click Save.

Defining event criteria and export fields

This procedure applies when you are currently defining a new data export integration in the Cequence UAP platform and have already configured the Overview tab.

1. Locate the event type section you want to configure.
   The following event types are available.
   1. Risk Events
   2. Bot Detection Events
   3. Bot Mitigation Events
   4. Audit Log Events
2. Enable the event type toggle.
3. In Event Criteria, click the pencil icon.
   The criteria builder appears.
4. In the Criteria pane, choose OR (match any) or AND (match all).
5. Choose a field, a condition, and a value.
   For example, country (field) equals (condition) mx (value), or Method does not equal GET.
6. To define another criterion, repeat the previous step.
7. Click Add.
8. In the Export Fields section, click the pencil icon.
   The field selector appears.
9. Select individual fields, or click Select all.
   Type a string in the search field to filter fields.
10. Choose a transformation from the drop-down for each selected field.
    The following transformations are available.
    • hash
    • show only last 4 characters
    • format preserving encryption (FPE)
    • None
11. Click Set.
12. Enter the transformation script.