ReConfirm Integration for Elastic
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Preview
Preview
Serverless Security
Preview
Preview
Stack
Preview
9.1+
Preview since 9.1
| Version | 0.1.0 Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Community |
| Ingestion method(s) | Webhook |
| Minimum Kibana version(s) | 9.1.0 8.19.0 |
The ReConfirm integration v0.1.0 is in technical preview
To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.
ReConfirm is an attack-surface and vulnerability scanning service. The ReConfirm integration for Elastic collects scan result webhooks (assets, open ports, lookalike/typosquat domains, subdomain exposure, and email security posture), normalizes the scan envelope to the Elastic Common Schema (ECS), and ships it to Elasticsearch so security teams can track their external attack surface over time.
ReConfirm delivers a scan result by POSTing a single JSON document to a user-configured HTTPS webhook URL when a scan completes. This integration stands up an HTTP endpoint (the Elastic Agent http_endpoint input) that receives that document. Incoming requests are authenticated with a static Authorization header, then reshaped and mapped to ECS.
The ingest pipeline reshapes dynamically keyed ReConfirm sections, such as assets by IP and subdomains by hostname, into bounded arrays to avoid creating unbounded Elasticsearch fields.
The ReConfirm integration collects one family of events:
- Vulnerability scan results — one document per completed scan, containing the scan metadata (who triggered it, target domain, start/end/outcome), discovered network assets and their open ports/services, lookalike/typosquat domains found for the target, subdomain exposure (active, offline, and unresolved), and the target domain's email security posture (DKIM/DMARC/SPF/MX).
Normalizing ReConfirm scan results to ECS in Elasticsearch makes attack-surface data searchable, visualizable, and correlatable alongside other sources. The collected fields support, for example:
- Attack-surface inventory: which IPs and ports are exposed, and what services/versions are running on them (
reconfirm.assets.*). - Brand-protection / typosquat monitoring: lookalike domains registered against the target, and whether they're actively impersonating it (
reconfirm.similar_domains.*). - Subdomain exposure tracking: which subdomains are live, offline, or no longer resolving, and which security headers they're missing (
reconfirm.subdomains.*). - Email spoofing risk: DKIM/DMARC/SPF/MX posture for the target domain (
reconfirm.email_security.*).
- An Elastic deployment (self-managed, Elastic Cloud, or Serverless) and an Elastic Agent.
- A ReConfirm account with permission to configure a scan webhook.
- A network path that allows ReConfirm's servers to reach the Agent's HTTPS endpoint (a public ingress, load balancer, or reverse proxy terminating TLS in front of the Agent).
Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.
Because ReConfirm requires the destination to be reachable over HTTPS from the public internet, terminate TLS either on the Agent (configure the SSL options on the input) or on a reverse proxy / load balancer placed in front of the Agent that forwards to the listener.
- In the ReConfirm dashboard, open the webhook/notification settings for the scan you want to forward.
- Set the webhook URL to the public HTTPS URL that reaches the Agent's listener (host/port plus the path configured below, e.g.
https://<your-host>/reconfirm). - Configure an
Authorizationheader whose value is a long, random shared secret, e.g.Bearer <token>, and configure the same value in Kibana (below). - Save and trigger a test scan.
- ReConfirm webhook implementation
- ReConfirm webhook payload schema — the JSON Schema definition (raw schema) this integration's ingest pipeline is built against.
- In Kibana, go to Management > Integrations, search for ReConfirm, and select Add ReConfirm.
- Configure the Collect ReConfirm scan results via webhook input:
- Listen Address and Listen Port — the address/port the Agent binds (defaults
0.0.0.0and port9023). - URL — the request path ReConfirm posts to (e.g.
/reconfirm); it must match the endpoint set in ReConfirm. - Authorization Token — the exact value ReConfirm sends in the
Authorizationheader, e.g.Bearer <token>. The listener fixes the header name toAuthorization; requests whose header value does not match are rejected with a 401. - Preserve Original Event — disabled by default. When enabled, the HTTP Endpoint input stores the raw request body in
event.original. Scan payloads can be several hundred KB, so this noticeably increases storage. - Redact Leaked Passwords — enabled by default. When enabled, leaked plaintext passwords in credential leak findings and
event.originalare replaced withREDACTED. - TLS — provide a certificate and key if the Agent terminates HTTPS directly.
- Listen Address and Listen Port — the address/port the Agent binds (defaults
- Save and deploy the integration to the Agent policy.
- In ReConfirm, trigger a test scan or test webhook delivery.
- In Kibana, open Discover and select the
logs-reconfirm.vulnerability-*data view to confirm scan results are arriving. - Confirm fields such as
reconfirm.scan.target,reconfirm.summary.assets_count, andreconfirm.summary.similar_domains_countare populated.
- No data is being collected: Confirm ReConfirm can reach the endpoint over HTTPS from the public internet, that the Agent is healthy, and that the listener address/port/path match the ReConfirm webhook configuration.
- All requests are rejected (401): Verify the Authorization Token in Kibana exactly matches the
Authorizationheader value configured in ReConfirm, including theBearerprefix. reconfirm.associated_domains,reconfirm.cred_leaks, or avulnsarray is missing from a document: these sections only appear when the corresponding ReConfirm module was enabled and found something during that scan; empty sections are dropped before indexing, so a missing field here does not indicate an ingest issue.
Each event is one full scan result and can be large (hundreds of KB) when a scan finds many assets, lookalike domains, or subdomains. Size the Agent and downstream ILM/retention policy for document size rather than event rate — ReConfirm scans typically complete far less often than most log sources emit events. For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.
These inputs can be used with this integration:
http_endpoint
For more details about the HTTP Endpoint input settings, check the Filebeat documentation.
To collect logs via HTTP Endpoint, select Collect logs via HTTP Endpoint and configure the following parameters:
- Listen Address: Bind address for the HTTP listener. Use 0.0.0.0 to listen on all interfaces.
- Listen port: Bind port for the listener.
The vulnerability data stream contains ReConfirm scan result events — discovered assets, lookalike domains, subdomain exposure, and email security posture. The raw event is preserved (when enabled) in event.original, and ReConfirm-specific context is kept under reconfirm.*.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| observer.product | The product name of the observer. | constant_keyword |
| observer.vendor | Vendor name of the observer. | constant_keyword |
| reconfirm.assets.ip | IP address of the discovered asset. | ip |
| reconfirm.assets.ports.description | Description of the open port. | keyword |
| reconfirm.assets.ports.name | Well-known name of the open port (e.g. https). |
keyword |
| reconfirm.assets.ports.port | Open port number on the asset. | long |
| reconfirm.assets.ports.service.name | Name of the service detected on the port. | keyword |
| reconfirm.assets.ports.service.version | Version of the service detected on the port, when identifiable. | keyword |
| reconfirm.assets.user_tags | User-assigned tags for the asset in ReConfirm. | keyword |
| reconfirm.assets.vulns.classification | Classification of the vulnerability scoring system (e.g. CVSS). Mirrors ECS vulnerability.classification. |
keyword |
| reconfirm.assets.vulns.cpe | CPE (Common Platform Enumeration) string identifying the affected product, when applicable. | keyword |
| reconfirm.assets.vulns.cvss_vector | CVSS vector string for the finding, e.g. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. |
keyword |
| reconfirm.assets.vulns.cwe_id | CWE (Common Weakness Enumeration) identifier of the underlying weakness, when applicable. | keyword |
| reconfirm.assets.vulns.description | Description of the vulnerability. Mirrors ECS vulnerability.description. | match_only_text |
| reconfirm.assets.vulns.enumeration | Type of identifier used in id (e.g. CVE). Mirrors ECS vulnerability.enumeration. |
keyword |
| reconfirm.assets.vulns.epss.percentile | EPSS percentile rank for the finding. | float |
| reconfirm.assets.vulns.epss.score | EPSS (Exploit Prediction Scoring System) probability score for the finding. | float |
| reconfirm.assets.vulns.finding_id | ReConfirm's identifier for this specific finding. | keyword |
| reconfirm.assets.vulns.id | CVE identifier of the vulnerability, when applicable. Mirrors ECS vulnerability.id. | keyword |
| reconfirm.assets.vulns.mitigation | ReConfirm's suggested mitigation for the finding. | match_only_text |
| reconfirm.assets.vulns.name | Name of the detection rule/template that produced this finding. | keyword |
| reconfirm.assets.vulns.reference | External references with additional information about the finding. Mirrors ECS vulnerability.reference. | keyword |
| reconfirm.assets.vulns.result | Raw matcher output/evidence from the detection template. | match_only_text |
| reconfirm.assets.vulns.score.base | CVSS base score for the finding. Mirrors ECS vulnerability.score.base. | float |
| reconfirm.assets.vulns.severity | Textual severity of the finding (Unknown/Info/Low/Medium/High/Critical), derived from ReConfirm's numeric severity. Mirrors ECS vulnerability.severity. | keyword |
| reconfirm.assets.vulns.url | URL where the finding was made, when applicable. | keyword |
| reconfirm.assets.vulns.user_tags | User-assigned tags for the finding in ReConfirm. | keyword |
| reconfirm.associated_domains.domain | Domain observed associated with the scan target. | keyword |
| reconfirm.associated_domains.page_title | HTML title of the page served at the associated domain, when reachable. | keyword |
| reconfirm.associated_domains.status_code | HTTP status code returned by the associated domain, when reachable. | long |
| reconfirm.associated_domains.time_seen | Number of times this domain was observed during the scan. | long |
| reconfirm.associated_domains.url | URL ReConfirm used to reach the associated domain. | keyword |
| reconfirm.cred_leaks.email | Email address the leaked credential was found for. | keyword |
| reconfirm.cred_leaks.last_breach | Identifier (name or date, as reported by ReConfirm) of the most recent breach this credential was seen in. | keyword |
| reconfirm.cred_leaks.password | Password value associated with the email address. This is set to REDACTED by default; disabling leaked-password redaction stores the plaintext value reported by ReConfirm. |
keyword |
| reconfirm.cred_leaks.sources | Breach/source names the credential was found in. | keyword |
| reconfirm.email_security.dkim.remark | Human-readable ReConfirm remark about the domain's DKIM configuration. | match_only_text |
| reconfirm.email_security.dkim.value | Raw DKIM DNS record value. | match_only_text |
| reconfirm.email_security.dmarc.remark | Human-readable ReConfirm remark about the domain's DMARC configuration. | match_only_text |
| reconfirm.email_security.dmarc.value | Raw DMARC DNS record value. | match_only_text |
| reconfirm.email_security.mx.remark | Human-readable ReConfirm remark about the domain's MX configuration. | match_only_text |
| reconfirm.email_security.mx.value | Mail server hostnames from the domain's MX records. | keyword |
| reconfirm.email_security.spf.remark | Human-readable ReConfirm remark about the domain's SPF configuration. | match_only_text |
| reconfirm.email_security.spf.value | Raw SPF DNS record value. | match_only_text |
| reconfirm.scan.description | Description of the scan as configured in ReConfirm. | keyword |
| reconfirm.scan.id | ReConfirm's identifier for this scan. Also copied to event.id. | keyword |
| reconfirm.scan.name | Name of the scan as configured in ReConfirm. | keyword |
| reconfirm.scan.target | Domain the scan was run against. | keyword |
| reconfirm.similar_domains.dns_a | IP addresses the similar domain's A record resolves to. | ip |
| reconfirm.similar_domains.dns_mx | Mail server hostnames from the similar domain's MX records. | keyword |
| reconfirm.similar_domains.dns_ns | Nameserver hostnames from the similar domain's NS records. | keyword |
| reconfirm.similar_domains.domain | A domain name similar to the scan target. | keyword |
| reconfirm.similar_domains.geoip | Country the similar domain's hosting IP geolocates to. | keyword |
| reconfirm.similar_domains.mx_ssl.expiration | Expiration date of the mail server's TLS certificate. | date |
| reconfirm.similar_domains.mx_ssl.host | Mail server hostname the certificate was observed on. | keyword |
| reconfirm.similar_domains.mx_ssl.issuer_cn | Common name of the mail server TLS certificate issuer. | keyword |
| reconfirm.similar_domains.mx_ssl.issuer_o | Organization of the mail server TLS certificate issuer. | keyword |
| reconfirm.similar_domains.mx_ssl.issuer_ou | Organizational unit of the mail server TLS certificate issuer. | keyword |
| reconfirm.similar_domains.mx_ssl.self_signed | Whether the mail server's TLS certificate is self-signed. | boolean |
| reconfirm.similar_domains.mx_ssl.subject_cn | Common name of the mail server TLS certificate subject. | keyword |
| reconfirm.similar_domains.mx_ssl.subject_o | Organization of the mail server TLS certificate subject. | keyword |
| reconfirm.similar_domains.mx_ssl.subject_ou | Organizational unit of the mail server TLS certificate subject. | keyword |
| reconfirm.similar_domains.mx_ssl.tls_version | TLS protocol version negotiated with the mail server. | keyword |
| reconfirm.similar_domains.page_title | HTML title of the page served at the similar domain, when reachable. | keyword |
| reconfirm.similar_domains.ssl.expiration | Expiration date of the similar domain's TLS certificate. | date |
| reconfirm.similar_domains.ssl.issuer_cn | Common name of the TLS certificate issuer. | keyword |
| reconfirm.similar_domains.ssl.issuer_o | Organization of the TLS certificate issuer. | keyword |
| reconfirm.similar_domains.ssl.issuer_ou | Organizational unit of the TLS certificate issuer. | keyword |
| reconfirm.similar_domains.ssl.self_signed | Whether the TLS certificate is self-signed. | boolean |
| reconfirm.similar_domains.ssl.subject_cn | Common name of the TLS certificate subject. | keyword |
| reconfirm.similar_domains.ssl.subject_o | Organization of the TLS certificate subject. | keyword |
| reconfirm.similar_domains.ssl.subject_ou | Organizational unit of the TLS certificate subject. | keyword |
| reconfirm.similar_domains.ssl.tls_version | TLS protocol version negotiated. | keyword |
| reconfirm.similar_domains.status_code | HTTP status code returned by the similar domain, when reachable. | long |
| reconfirm.subdomains.active.headers_found.name | Name of the HTTP response header. | keyword |
| reconfirm.subdomains.active.headers_found.security_impact | ReConfirm's security-impact score for the presence of this header. | long |
| reconfirm.subdomains.active.headers_found.value | Value of the HTTP response header. | match_only_text |
| reconfirm.subdomains.active.headers_missing | Names of security-relevant HTTP response headers missing on the subdomain. | keyword |
| reconfirm.subdomains.active.headers_missing_grade | ReConfirm's grading impact of the missing headers, when available. | keyword |
| reconfirm.subdomains.active.hostname | Hostname of the active subdomain. | keyword |
| reconfirm.subdomains.active.ips | IP addresses the subdomain resolves to. | ip |
| reconfirm.subdomains.active.page_title | HTML title of the page served at the subdomain. | keyword |
| reconfirm.subdomains.active.ports.description | Description of the open port. | keyword |
| reconfirm.subdomains.active.ports.name | Well-known name of the open port (e.g. https). |
keyword |
| reconfirm.subdomains.active.ports.port | Open port number on the subdomain. | long |
| reconfirm.subdomains.active.ports.service.name | Name of the service detected on the port. | keyword |
| reconfirm.subdomains.active.ports.service.version | Version of the service detected on the port, when identifiable. | keyword |
| reconfirm.subdomains.active.ssl_grade | ReConfirm's grading of the subdomain's TLS configuration, when available. | keyword |
| reconfirm.subdomains.active.ssl_info.expiration | Expiration date of the active subdomain's TLS certificate. | date |
| reconfirm.subdomains.active.ssl_info.issuer_cn | Common name of the TLS certificate issuer. | keyword |
| reconfirm.subdomains.active.ssl_info.issuer_o | Organization of the TLS certificate issuer. | keyword |
| reconfirm.subdomains.active.ssl_info.issuer_ou | Organizational unit of the TLS certificate issuer. | keyword |
| reconfirm.subdomains.active.ssl_info.self_signed | Whether the TLS certificate is self-signed. | boolean |
| reconfirm.subdomains.active.ssl_info.subject_cn | Common name of the TLS certificate subject. | keyword |
| reconfirm.subdomains.active.ssl_info.subject_o | Organization of the TLS certificate subject. | keyword |
| reconfirm.subdomains.active.ssl_info.subject_ou | Organizational unit of the TLS certificate subject. | keyword |
| reconfirm.subdomains.active.ssl_info.tls_version | TLS protocol version negotiated. | keyword |
| reconfirm.subdomains.active.status_code | HTTP status code returned by the subdomain. | long |
| reconfirm.subdomains.active.suffixes.size | Human-readable size of the response, e.g. 12 KB. |
keyword |
| reconfirm.subdomains.active.suffixes.status_code | HTTP status code returned for the suffix/path. | long |
| reconfirm.subdomains.active.suffixes.suffix | Discovered suffix/path. | keyword |
| reconfirm.subdomains.active.url | URL ReConfirm used to reach the subdomain. | keyword |
| reconfirm.subdomains.active.user_tags | User-assigned tags for the subdomain in ReConfirm. | keyword |
| reconfirm.subdomains.active.vulns.classification | Classification of the vulnerability scoring system (e.g. CVSS). Mirrors ECS vulnerability.classification. |
keyword |
| reconfirm.subdomains.active.vulns.cpe | CPE (Common Platform Enumeration) string identifying the affected product, when applicable. | keyword |
| reconfirm.subdomains.active.vulns.cvss_vector | CVSS vector string for the finding, e.g. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. |
keyword |
| reconfirm.subdomains.active.vulns.cwe_id | CWE (Common Weakness Enumeration) identifier of the underlying weakness, when applicable. | keyword |
| reconfirm.subdomains.active.vulns.description | Description of the vulnerability. Mirrors ECS vulnerability.description. | match_only_text |
| reconfirm.subdomains.active.vulns.enumeration | Type of identifier used in id (e.g. CVE). Mirrors ECS vulnerability.enumeration. |
keyword |
| reconfirm.subdomains.active.vulns.epss.percentile | EPSS percentile rank for the finding. | float |
| reconfirm.subdomains.active.vulns.epss.score | EPSS (Exploit Prediction Scoring System) probability score for the finding. | float |
| reconfirm.subdomains.active.vulns.finding_id | ReConfirm's identifier for this specific finding. | keyword |
| reconfirm.subdomains.active.vulns.id | CVE identifier of the vulnerability, when applicable. Mirrors ECS vulnerability.id. | keyword |
| reconfirm.subdomains.active.vulns.ip | IP address the finding was made against. | ip |
| reconfirm.subdomains.active.vulns.mitigation | ReConfirm's suggested mitigation for the finding. | match_only_text |
| reconfirm.subdomains.active.vulns.name | Name of the detection rule/template that produced this finding. | keyword |
| reconfirm.subdomains.active.vulns.reference | External references with additional information about the finding. Mirrors ECS vulnerability.reference. | keyword |
| reconfirm.subdomains.active.vulns.result | Raw matcher output/evidence from the detection template. | match_only_text |
| reconfirm.subdomains.active.vulns.score.base | CVSS base score for the finding. Mirrors ECS vulnerability.score.base. | float |
| reconfirm.subdomains.active.vulns.severity | Textual severity of the finding (Unknown/Info/Low/Medium/High/Critical), derived from ReConfirm's numeric severity. Mirrors ECS vulnerability.severity. | keyword |
| reconfirm.subdomains.active.vulns.url | URL where the finding was made, when applicable. | keyword |
| reconfirm.subdomains.active.vulns.user_tags | User-assigned tags for the finding in ReConfirm. | keyword |
| reconfirm.subdomains.offline | Hostnames of subdomains that resolve but did not respond. | keyword |
| reconfirm.subdomains.unresolved | Hostnames of subdomains that did not resolve at all. | keyword |
| reconfirm.summary.assets_count | Number of assets discovered by the scan. Derived at ingest time. | long |
| reconfirm.summary.associated_domains_count | Number of domains associated with the scan target. Derived at ingest time. | long |
| reconfirm.summary.cred_leaks_count | Number of leaked-credential findings for the scan target. Derived at ingest time. | long |
| reconfirm.summary.similar_domains_count | Number of similar/lookalike domains found by the scan. Derived at ingest time. | long |
| reconfirm.summary.subdomains_active_count | Number of active subdomains found by the scan. Derived at ingest time. | long |
| reconfirm.summary.subdomains_unresolved_count | Number of unresolved subdomains found by the scan. Derived at ingest time. | long |
| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
| source.as.organization.name | Organization name. | keyword |
| source.as.organization.name.text | Multi-field of source.as.organization.name. |
match_only_text |
| source.geo.city_name | City name. | keyword |
| source.geo.continent_name | Name of the continent. | keyword |
| source.geo.country_iso_code | Country ISO code. | keyword |
| source.geo.country_name | Country name. | keyword |
| source.geo.location | Longitude and latitude. | geo_point |
| source.geo.region_iso_code | Region ISO code. | keyword |
| source.geo.region_name | Region name. | keyword |
Example
{
"@timestamp": "2026-07-29T19:46:14.000Z",
"agent": {
"ephemeral_id": "dc70b92f-748e-40ad-9f2c-dab493ecb0ae",
"id": "13053e74-cf71-4b4d-a46f-4a56114baac7",
"name": "elastic-agent-12337",
"type": "filebeat",
"version": "8.19.22"
},
"data_stream": {
"dataset": "reconfirm.vulnerability",
"namespace": "77996",
"type": "logs"
},
"ecs": {
"version": "9.4.0"
},
"elastic_agent": {
"id": "13053e74-cf71-4b4d-a46f-4a56114baac7",
"snapshot": false,
"version": "8.19.22"
},
"event": {
"agent_id_status": "verified",
"category": [
"vulnerability"
],
"dataset": "reconfirm.vulnerability",
"end": "2026-07-29T19:46:14+00:00",
"id": "579dcddc",
"ingested": "2026-09-29T08:22:27Z",
"kind": "event",
"original": "{\"info\":{\"desc\":\"\",\"end\":\"2026-07-29T19:46:14+00:00\",\"name\":\"weekly scan\",\"start\":\"2026-07-29T19:21:55+00:00\",\"success\":true},\"issuer\":{\"email\":\"jane.doe@example.com\",\"ip\":\"203.0.113.10\",\"name\":\"Jane Doe\"},\"results\":{\"assets\":{\"198.51.100.10\":{\"ports\":{\"443\":{\"description\":\"http protocol over TLS/SSL\",\"name\":\"https\",\"service\":{\"name\":\"nginx\",\"version\":\"1.18.0\"}},\"80\":{\"description\":\"World Wide Web HTTP\",\"name\":\"www-http\",\"service\":{\"name\":\"nginx\",\"version\":\"1.18.0\"}}},\"user_tags\":[],\"vulns\":{}},\"198.51.100.11\":{\"ports\":{\"22\":{\"description\":\"Secure Shell\",\"name\":\"ssh\",\"service\":{\"name\":\"OpenSSH\",\"version\":null}}},\"user_tags\":[\"monitored\"],\"vulns\":{\"CVE-2023-1234\":{\"cpe\":\"cpe:2.3:a:openbsd:openssh:8.0:*:*:*:*:*:*:*\",\"cve_id\":\"CVE-2023-1234\",\"cvss_metrics\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"cvss_score\":5.9,\"cwe_id\":\"CWE-327\",\"desc\":\"The SSH server supports weak key exchange algorithms.\",\"epss_percentile\":0.81,\"epss_score\":0.023,\"mitigation\":\"Disable weak KEX algorithms in sshd_config.\",\"name\":\"OpenSSH weak KEX algorithms\",\"references\":[\"https://nvd.nist.gov/vuln/detail/CVE-2023-1234\"],\"result\":[\"diffie-hellman-group1-sha1\"],\"severity\":3,\"url\":null,\"user_tags\":[]}}}},\"associated_domains\":{\"cdn.example.net\":{\"page_title\":\"Example CDN\",\"status_code\":200,\"time_seen\":3,\"url\":\"https://cdn.example.net/assets/main.js\"}},\"cred_leaks\":{\"jane.doe@example.com\":[{\"last_breach\":\"2023-11-02\",\"password\":\"REDACTED\",\"sources\":[\"ExampleBreachCo\"]}]},\"email_security\":{\"dkim\":{\"remark\":\"DKIM is setup for this email server.\",\"value\":\"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB...\"},\"dmarc\":{\"remark\":\"You are at the highest level!\",\"value\":\"v=DMARC1; p=reject; rua=mailto:soc@example.com\"},\"mx\":{\"remark\":\"You have a single mail server setup.\",\"value\":[\"mail.example.com.\"]},\"spf\":{\"remark\":\"SPF seems to be setup correctly!\",\"value\":\"v=spf1 a mx ip4:203.0.113.0/24 ~all\"}},\"similar_domains\":{\"examp1e.com\":{\"dns\":{\"a\":[\"198.51.100.20\"],\"mx\":[\"mailx.example-registrar.com\"],\"ns\":[\"ns1.example-registrar.com\",\"ns2.example-registrar.com\"]},\"geoip\":\"Germany\",\"mx_ssl\":{\"mailx.example-registrar.com\":{\"expiration\":\"2029-09-14T15:09:55+00:00\",\"issuer_cn\":\"\\u003cNot Part Of Certificate\\u003e\",\"issuer_o\":\"ExampleCA\",\"issuer_ou\":\"\\u003cNot Part Of Certificate\\u003e\",\"self_signed\":true,\"subject_cn\":\"\\u003cNot Part Of Certificate\\u003e\",\"subject_o\":\"ExampleCA\",\"subject_ou\":\"\\u003cNot Part Of Certificate\\u003e\",\"tls_version\":\"TLSv1.3\"}},\"page_title\":\"Domain for sale\",\"ssl\":{\"expiration\":\"2026-10-14T11:47:08+00:00\",\"issuer_cn\":\"R11\",\"issuer_o\":\"Let's Encrypt\",\"issuer_ou\":\"\\u003cNot Part Of Certificate\\u003e\",\"self_signed\":false,\"subject_cn\":\"examp1e.com\",\"subject_o\":\"\\u003cNot Part Of Certificate\\u003e\",\"subject_ou\":\"\\u003cNot Part Of Certificate\\u003e\",\"tls_version\":\"TLSv1.3\"},\"status_code\":200},\"exampl3.com\":{\"dns\":{\"a\":null,\"mx\":null,\"ns\":null},\"geoip\":null,\"mx_ssl\":null,\"page_title\":null,\"ssl\":null,\"status_code\":null}},\"subdomains\":{\"active\":{\"api.example.com\":{\"headers\":{\"found\":{},\"missing\":{\"grade\":\"F\",\"headers\":[\"Content-Security-Policy\",\"X-Frame-Options\"]}},\"ips\":[\"203.0.113.51\"],\"page_title\":null,\"ports\":{},\"ssl\":{\"grade\":null,\"info\":{}},\"status_code\":404,\"suffixes\":{},\"url\":\"https://api.example.com\",\"user_tags\":[],\"vulns\":{\"finding-xyz\":{\"cpe\":null,\"cve_id\":null,\"cvss_metrics\":null,\"cvss_score\":null,\"cwe_id\":\"CWE-306\",\"desc\":\"An administrative interface is exposed without authentication.\",\"epss_percentile\":null,\"epss_score\":null,\"ip\":\"203.0.113.51\",\"mitigation\":\"Restrict access to the admin panel by IP allowlist.\",\"name\":\"Exposed admin panel\",\"references\":[],\"result\":[\"HTTP 200 on /admin\"],\"severity\":4,\"url\":\"https://api.example.com/admin\",\"user_tags\":[\"reviewed\"]}}},\"portal.example.com\":{\"headers\":{\"found\":{\"Content-Type\":{\"security_impact\":0,\"value\":\"text/html; charset=utf-8\"},\"X-Frame-Options\":{\"security_impact\":1,\"value\":\"DENY\"}},\"missing\":{\"grade\":null,\"headers\":[]}},\"ips\":[\"203.0.113.50\"],\"page_title\":\"Example Portal\",\"ports\":{\"443\":{\"description\":\"http protocol over TLS/SSL\",\"name\":\"https\",\"service\":null},\"80\":{\"description\":\"World Wide Web HTTP\",\"name\":\"www-http\",\"service\":\"nginx\",\"version\":\"1.25.3\"}},\"ssl\":{\"grade\":\"A\",\"info\":{\"expiration\":\"2026-11-01T08:00:00+00:00\",\"issuer_cn\":\"R11\",\"issuer_o\":\"Let's Encrypt\",\"issuer_ou\":null,\"self_signed\":false,\"subject_cn\":\"portal.example.com\",\"subject_o\":null,\"subject_ou\":null,\"tls_version\":\"TLSv1.3\"}},\"status_code\":200,\"suffixes\":{\"/admin\":{\"size\":\"4.2 KB\",\"status_code\":403},\"/backup.zip\":{\"size\":\"1.1 MB\",\"status_code\":200}},\"url\":\"https://portal.example.com\",\"user_tags\":[],\"vulns\":{}}},\"offline\":[\"old.example.com\"],\"unresolved\":[\"staging.example.com\",\"dev.example.com\"]}},\"scan_id\":\"579dcddc\",\"target\":{\"domain\":\"example.com\"}}",
"outcome": "success",
"start": "2026-07-29T19:21:55+00:00",
"type": [
"info"
]
},
"input": {
"type": "http_endpoint"
},
"observer": {
"product": "Attack Surface Scan",
"vendor": "ReConfirm"
},
"reconfirm": {
"assets": [
{
"ip": "198.51.100.11",
"ports": [
{
"description": "Secure Shell",
"name": "ssh",
"port": 22,
"service": {
"name": "OpenSSH"
}
}
],
"user_tags": [
"monitored"
],
"vulns": [
{
"classification": "CVSS",
"cpe": "cpe:2.3:a:openbsd:openssh:8.0:*:*:*:*:*:*:*",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe_id": "CWE-327",
"description": "The SSH server supports weak key exchange algorithms.",
"enumeration": "CVE",
"epss": {
"percentile": 0.81,
"score": 0.023
},
"finding_id": "CVE-2023-1234",
"id": "CVE-2023-1234",
"mitigation": "Disable weak KEX algorithms in sshd_config.",
"name": "OpenSSH weak KEX algorithms",
"reference": [
"https://nvd.nist.gov/vuln/detail/CVE-2023-1234"
],
"result": [
"diffie-hellman-group1-sha1"
],
"score": {
"base": 5.9
},
"severity": "High"
}
]
},
{
"ip": "198.51.100.10",
"ports": [
{
"description": "http protocol over TLS/SSL",
"name": "https",
"port": 443,
"service": {
"name": "nginx",
"version": "1.18.0"
}
},
{
"description": "World Wide Web HTTP",
"name": "www-http",
"port": 80,
"service": {
"name": "nginx",
"version": "1.18.0"
}
}
]
}
],
"associated_domains": [
{
"domain": "cdn.example.net",
"page_title": "Example CDN",
"status_code": 200,
"time_seen": 3,
"url": "https://cdn.example.net/assets/main.js"
}
],
"cred_leaks": [
{
"email": "jane.doe@example.com",
"last_breach": "2023-11-02",
"password": "REDACTED",
"sources": [
"ExampleBreachCo"
]
}
],
"email_security": {
"dkim": {
"remark": "DKIM is setup for this email server.",
"value": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB..."
},
"dmarc": {
"remark": "You are at the highest level!",
"value": "v=DMARC1; p=reject; rua=mailto:soc@example.com"
},
"mx": {
"remark": "You have a single mail server setup.",
"value": [
"mail.example.com."
]
},
"spf": {
"remark": "SPF seems to be setup correctly!",
"value": "v=spf1 a mx ip4:203.0.113.0/24 ~all"
}
},
"scan": {
"id": "579dcddc",
"name": "weekly scan",
"target": "example.com"
},
"similar_domains": [
{
"dns_a": [
"198.51.100.20"
],
"dns_mx": [
"mailx.example-registrar.com"
],
"dns_ns": [
"ns1.example-registrar.com",
"ns2.example-registrar.com"
],
"domain": "examp1e.com",
"geoip": "Germany",
"mx_ssl": [
{
"expiration": "2029-09-14T15:09:55+00:00",
"host": "mailx.example-registrar.com",
"issuer_cn": "<Not Part Of Certificate>",
"issuer_o": "ExampleCA",
"issuer_ou": "<Not Part Of Certificate>",
"self_signed": true,
"subject_cn": "<Not Part Of Certificate>",
"subject_o": "ExampleCA",
"subject_ou": "<Not Part Of Certificate>",
"tls_version": "TLSv1.3"
}
],
"page_title": "Domain for sale",
"ssl": {
"expiration": "2026-10-14T11:47:08+00:00",
"issuer_cn": "R11",
"issuer_o": "Let's Encrypt",
"issuer_ou": "<Not Part Of Certificate>",
"self_signed": false,
"subject_cn": "examp1e.com",
"subject_o": "<Not Part Of Certificate>",
"subject_ou": "<Not Part Of Certificate>",
"tls_version": "TLSv1.3"
},
"status_code": 200
},
{
"domain": "exampl3.com"
}
],
"subdomains": {
"active": [
{
"headers_found": [
{
"name": "X-Frame-Options",
"security_impact": 1,
"value": "DENY"
},
{
"name": "Content-Type",
"security_impact": 0,
"value": "text/html; charset=utf-8"
}
],
"hostname": "portal.example.com",
"ips": [
"203.0.113.50"
],
"page_title": "Example Portal",
"ports": [
{
"description": "http protocol over TLS/SSL",
"name": "https",
"port": 443
},
{
"description": "World Wide Web HTTP",
"name": "www-http",
"port": 80,
"service": {
"name": "nginx",
"version": "1.25.3"
}
}
],
"ssl_grade": "A",
"ssl_info": {
"expiration": "2026-11-01T08:00:00+00:00",
"issuer_cn": "R11",
"issuer_o": "Let's Encrypt",
"self_signed": false,
"subject_cn": "portal.example.com",
"tls_version": "TLSv1.3"
},
"status_code": 200,
"suffixes": [
{
"size": "4.2 KB",
"status_code": 403,
"suffix": "/admin"
},
{
"size": "1.1 MB",
"status_code": 200,
"suffix": "/backup.zip"
}
],
"url": "https://portal.example.com"
},
{
"headers_missing": [
"Content-Security-Policy",
"X-Frame-Options"
],
"headers_missing_grade": "F",
"hostname": "api.example.com",
"ips": [
"203.0.113.51"
],
"status_code": 404,
"url": "https://api.example.com",
"vulns": [
{
"cwe_id": "CWE-306",
"description": "An administrative interface is exposed without authentication.",
"finding_id": "finding-xyz",
"ip": "203.0.113.51",
"mitigation": "Restrict access to the admin panel by IP allowlist.",
"name": "Exposed admin panel",
"result": [
"HTTP 200 on /admin"
],
"severity": "Critical",
"url": "https://api.example.com/admin",
"user_tags": [
"reviewed"
]
}
]
}
],
"offline": [
"old.example.com"
],
"unresolved": [
"staging.example.com",
"dev.example.com"
]
},
"summary": {
"assets_count": 2,
"associated_domains_count": 1,
"cred_leaks_count": 1,
"similar_domains_count": 2,
"subdomains_active_count": 2,
"subdomains_unresolved_count": 2
}
},
"related": {
"hosts": [
"portal.example.com",
"api.example.com",
"cdn.example.net",
"example.com"
],
"ip": [
"198.51.100.11",
"198.51.100.10",
"198.51.100.20",
"203.0.113.50",
"203.0.113.51",
"203.0.113.10"
],
"user": [
"jane.doe@example.com"
]
},
"source": {
"as": {
"number": 64502,
"organization": {
"name": "Documentation ASN"
}
},
"geo": {
"city_name": "Madrid",
"continent_name": "Europe",
"country_iso_code": "ES",
"country_name": "Spain",
"location": {
"lat": 40.41639,
"lon": -3.7025
},
"region_iso_code": "ES-M",
"region_name": "Madrid"
},
"ip": "203.0.113.10"
},
"tags": [
"forwarded",
"reconfirm-vulnerability",
"preserve_original_event"
],
"user": {
"email": "jane.doe@example.com",
"full_name": "Jane Doe"
}
}
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 0.1.0 | Enhancement (View pull request) Initial release of the ReConfirm integration. |
9.1.0 8.19.0 |