# Threat Intel Module for Elastic cloud **URL:** \ **Category:** SIEM\ **Created:** [April 25, 2021, 4:35pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198 "2021-04-25T16:35:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![zoot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoot/32/87700_2.png) [@zoot](https://discuss.elastic.co/u/zoot)\ **Post date:** [April 25, 2021, 4:35pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/1 "2021-04-25T16:35:06Z")
Hi, I am using Elastic Cloud for SEIM + Endpoint Security usecase. I want to integrate OTX as threat intel source but from the documentation it seems I need to use some different system instead of adding integration directly into Elastic SIEM (cloud) by adding my API KEY and OTX URL. Please guide how to make it work? I have only productivity desktops on-prem which are configured with Elastic Agent for log collection and Antivirus. Thanks Faisal. ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [April 27, 2021, 1:29am UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/2 "2021-04-27T01:29:08Z")
OTX ingest is done via the filebeat module (may also have an agent package as well). Then filebeat will push it to elasticsearch ---
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [April 27, 2021, 4:53pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/3 "2021-04-27T16:53:55Z")
What we do is we have a separate ELK instance which consumes the OTX data on a day to day basis, which our main cluster correlate with it. You want to do whatever you can do to lessen the impact the processing power of the master node and etc. ---
**Author:** ![zoot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoot/32/87700_2.png) [@zoot](https://discuss.elastic.co/u/zoot)\ **Post date:** [April 27, 2021, 5:22pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/4 "2021-04-27T17:22:18Z")
Thanks legoguy1000. This mean we need a local instance with filebeat agent installed ? But a more logical design could be to directly ingest into Elastic. Any idea why the CTI ingestion is designed like this? Thanks Faisal. ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [April 27, 2021, 5:37pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/5 "2021-04-27T17:37:21Z")
so Filebeat does push to Elastic. It just acts as a middle man since ES its self isn't designed to pull in information and there is nothing saying that a 3rd party service couldn't have a native ES push mechanism but that would require your ES server to be exposed to that as opposed to a FIlebeat polling and pushing locally so nothing is exposed. ---
**Author:** ![zoot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoot/32/87700_2.png) [@zoot](https://discuss.elastic.co/u/zoot)\ **Post date:** [April 27, 2021, 5:40pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/6 "2021-04-27T17:40:17Z")
> [@legoguy1000](#): > > mechanism but that would require your ES server to be exposed to that as opposed to a FIlebeat polling and pushing locally so nothing is exposed. OK thanks for clarifying. All i need is to install filebeat on any machine to ingest threat intel, my apprehension is correct? The same filebeat PC or Server will also act as collector of other syslog sources in the network? Thanks ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [April 27, 2021, 6:01pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/7 "2021-04-27T18:01:10Z")
Ya, as long as Filebeat can reach the API for the threat intel source and the ES server, you should be good. and yes, YOu cna multiple modules running on Filebeat at once with the different inputs. ---
**Author:** ![zoot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoot/32/87700_2.png) [@zoot](https://discuss.elastic.co/u/zoot)\ **Post date:** [April 28, 2021, 4:15pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/8 "2021-04-28T16:15:00Z")
Thanks alot for your expert advice. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 26, 2021, 4:15pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198/9 "2021-05-26T16:15:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.