# Elastic SIEM integration with Ansible for Security Automation

**URL:** <https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915>\
**Category:** SIEM\
**Created:** [July 4, 2019, 12:59pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915 "2019-07-04T12:59:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![imran](https://avatars.discourse-cdn.com/v4/letter/i/7feea3/32.png) [@imran](https://discuss.elastic.co/u/imran)\
**Post date:** [July 4, 2019, 12:59pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915/1 "2019-07-04T12:59:06Z")

</div>

Hi,

I wanted to know if there is a possibility where in Ansible can be integrated with the elastic SIEM app to take some automated actions against security events so that we can build a custom SOAR functionality rather than depending on third party apps for achieving SOAR.

If there is a possibility please do briefly explain or give some referrence documentation for my perusal.

Thank You

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [July 4, 2019, 2:59pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915/2 "2019-07-04T14:59:17Z")

</div>

Hi @imran - how are you planning to use Ansible for SOAR? Do you have some kind of automation/orchestration framework for that?

In general, the Elastic SIEM is using data already in Elasticsearch, so the way to do it would be to query Elasticsearch and then trigger Ansible based on the response.

---

<div class="post-metadata">

**Author:** ![imran](https://avatars.discourse-cdn.com/v4/letter/i/7feea3/32.png) [@imran](https://discuss.elastic.co/u/imran)\
**Post date:** [July 15, 2019, 11:11am UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915/3 "2019-07-15T11:11:16Z")

</div>

Hello Christoph,

Sorry for the delay in response. We were thinking of designing the solution in a way, where the watcher will invoke ansible playbooks from the actions section...

We were also thinking about using theHive for getting the watcher create security incidents into theHive and then maybe use theHive to invoke automation scripts.

Do let me know if you have any info or a use case regarding this...

Rgds,  
Imran

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [July 15, 2019, 1:53pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915/4 "2019-07-15T13:53:09Z")

</div>

@imran You can use Logstash to connect Watcher with Ansible:

`Watcher -> Logstash -> Ansible`

You can use the Webhook action in Watcher to trigger Logstash, and use an Exec output to run Ansible on the command line.

There are also automation tools like Rundeck that you can use to run Ansible. Again, you can use Logstash to trigger Rundeck through its API.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2019, 1:59pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915/5 "2019-08-12T13:59:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.