Hi There, Is there a possibility of extracting all the raw documents of elasticsearch with respect to SIEM events . For example if we have rule name : [Unusual Login Activity] and we have enabled this particular out of the box rule in SIEM app and if we are able to see all the related events in …

Extraction Elastic SIEM security events

Frank_Hassanabad (Frank Hassanabad) November 18, 2020, 8:38pm 6

You might be able to use some features from reporting for things outside of CSV such as a PDF:

But I am careful about talking about these parts of Kibana that I haven't done much work just yet.

Action export selected signals to csv

Topic		Replies	Views
External alerts via API SIEM	2	573	December 30, 2020
Integrate Events into Elastic SIEM SIEM	5	1149	April 19, 2020
Elastic 7.9.1 - Security (SIEM) - Your visualization has error(s) - [illegal_argument_exception] SIEM	16	2246	November 9, 2020
Extracting raw logs from ELK to SPlunk Elasticsearch	1	374	December 4, 2018
Sonicwall firewall SIEM Elastic Security	15	1480	November 4, 2022