# Open Source SOAR integration with ELK

**URL:** <https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [April 24, 2024, 9:54am UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108 "2024-04-24T09:54:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amjadkhan\_291](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@amjadkhan\_291](https://discuss.elastic.co/u/amjadkhan_291)\
**Post date:** [April 24, 2024, 9:54am UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108/1 "2024-04-24T09:54:40Z")

</div>

Hello All,  
Can anyone please suggest open source SOAR that works well with ELK Stack?

Thank You.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 24, 2024, 11:00am UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108/2 "2024-04-24T11:00:19Z")

</div>

Would this help?

> **[SOAR | Security Orchestration, Automation, and Response](https://www.elastic.co/security/soar)**
>
> Elastic Security for SOAR applies orchestration and automation to elevate the impact of every security analyst, equipping the SOC to quash attacks before damage goes.
> ...

---

<div class="post-metadata">

**Author:** ![amjadkhan\_291](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@amjadkhan\_291](https://discuss.elastic.co/u/amjadkhan_291)\
**Post date:** [April 24, 2024, 11:32am UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108/3 "2024-04-24T11:32:48Z")

</div>

Hi, thanks for sharing.  
This talk about case management in ELK Security.  
Does ELK have SOAR platform for automation & Response? Please share the documentation if you have it.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 24, 2024, 11:56am UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108/4 "2024-04-24T11:56:47Z")

</div>

On the same page I linked, if you go down, you will see more information. Not only the talk.

> ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a8aac7dcce4bc20a1d1128512b6a52e7840dc93.png)
> 
> ## Automate investigation and response
> 
> Automate repetitive steps to unleash analysts to tackle problems meriting human creativity and problem solving. Deploy autonomous and analyst-invoked actions to end attacks faster than they start. Begin with built-in actions and progress further with custom responses. Evolve into advanced workflows enabled by integrations with third-party platforms.
> 
> [Investigation and incident response](https://www.elastic.co/security/investigation-response)

If you click on that [link](https://www.elastic.co/security/investigation-response), it gives another page:

I'm not expert at all in that domain so I don't know if that answers your question.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 24, 2024, 12:39pm UTC](https://discuss.elastic.co/t/open-source-soar-integration-with-elk/358108/5 "2024-04-24T12:39:25Z")

</div>

Elastic does not have a SOAR, they have integrations with some SOAR tools, but these integrations requires a paid license.

If you are using the basic license you will need to write something to get the data from your elasticsearch and send to your SOAR, or use a third party tool that already can do that, like ElastAlert2 that can send data using a https webhook.

One opensource SOAR that you can use is Shuffle ([https://shuffler.io](https://shuffler.io))