Hi There, Is there a possibility of extracting all the raw documents of elasticsearch with respect to SIEM events . For example if we have rule name : [Unusual Login Activity] and we have enabled this particular out of the box rule in SIEM app and if we are able to see all the related events in …

Extraction Elastic SIEM security events

Frank_Hassanabad (Frank Hassanabad) November 18, 2020, 8:38pm 6

You might be able to use some features from reporting for things outside of CSV such as a PDF:

But I am careful about talking about these parts of Kibana that I haven't done much work just yet.

Action export selected signals to csv

Topic		Replies	Views
Get events of an specific rule SIEM elastic-stack-alerting	4	421	June 3, 2022
Threat Hunting Report for Elasticsearch SIEM	11	1416	October 7, 2020
Getting SIEM alerts through API SIEM	5	723	January 18, 2023
External alerts via API SIEM	2	573	December 30, 2020
Keeping same log events once instead of multiple time Logstash	6	902	July 29, 2020