Input Configuration

Case-Hub Input Configuration

Inputs control how the Case-Hub collects event data from the configured backend. Inputs are consumed by Agents, which then are tasked with polling that Input for data and processing it into a format the Case-Hub API can understand.

Creating Inputs

Prior to creating a new input, create credentials for the input and then follow the below steps to create an Input:

  1. Navigate to the System -> Inputs page from the Dashboard, Click "New Input"

  2. Provide required backend configuration details for the input, starting with an appropriate Input Name, Description, and Tags.

  3. Select the plugin "ElasticSearch" you want to configure, check Plugin Configuration

  4. Select the credentials this input should use to connect to the configured plugin.

  5. Plugin Configuration - Provide the configuration for Elasticsearch like Distro, Index to query, HTTP Auth Method.

  6. Event Base Configuration - Add the relevant event fields like Title, Description, Severity, Tags, and others.

  7. Additional Configuration - Add all the relevant Field Mappings.

  8. Select the SIGMA Pipeline, and MITRE data sources that apply.

  9. Review - Confirm the input configurations, click Create

Plugin Configuration

In order for the Input plugin to properly work, it should be properly configured.


When configuring your Input, this section of configuration will tell Case-Hub how to interact with Elasticsearch.

Elastic-Search FieldsDescription

Elasticsearch Hosts

Provide the address of the Elasticsearch host (e.g.,https://localhost:9200)


Select the distro (distributed version) of Elasticsearch to use

Alert Index

Index where Case-Hub should look for Events

Lucene Filter

Use it to filter what Events are to be pulled into Case-Hub

HTTP Scheme

Choice to connect to Elasticsearch over HTTP or HTTPS

Auth Method

Choose how to Authenticate with Elasticsearch -

Elastic API key or Basic Authentication

CA Cert Path

Path to your clusters certificate authority (CA) public certificate

Verify Hostname

Option to verify the hostname

TLS Verification Mode

TLS Mode will use for verification

Event Base Configuration

This section of configuration determines what data is included in an Event shipped by an Agent.

Event Base ConfigurationDescription

Event Title Field

Title of the Events as they will appear in the Event Queue

Description Field

Description to be extracted for the Event

Reference Field

Defines a field that will provide a unique value each Event

Severity Field

The field that determines the severity of the Event on a scale of 1-4

Original Date Field

Preserves the original time the alert was generated

Tag Fields

Fields to derive tags from that will appear on the side of an Event card

Signature Fields

A single field or a combination of fields is used to compute an Event's signature.

Search Size

Define the number of Events to return by the agent on each poll

Search Period

Determines how far back in time to go in the source index

Static Tags

Tags that will always be applied to these Events

Additional Configuration

Field Mappings

Field mappings determine how source data is mapped to a particular data type in the Case-Hub. This process involves extracting relevant information that will be displayed as Observables on Event cards on the Event-Queue page. For instance, if you map an IP address to the IP data type, you can perform CIDR notation checks using RQL.

Sigma Configuration (Beta)

By providing Sigma configurations, Detections can automatically convert Sigma rules that use this input to the target pipeline and backend. The selected values can be overridden during the Sigma to Detection conversion process.

MITRE Configuration (Beta)

Data sources allow you to define what specific data sources (logs) will be provided for this input when aligned with the MITRE ATT&CK framework of attack techniques and tactics. By utilizing these data sources, Detections can automatically recommend other Detections that require specific data sources.

Last updated