SOCRadar Integration

The SOCRadar integration collects security alarms from the SOCRadar platform via its REST API and ingests them into Elasticsearch. Each alarm is stored as a log event in the logs-socradar_alert.incidents-* data stream.

Alarms are indexed as ECS event.kind: alert documents that can be explored in Kibana Discover and the included dashboard.

This integration is compatible with SOCRadar API v4.

The integration uses the CEL input to poll the SOCRadar REST API at a configurable interval. On first run, it fetches alarms from a configurable lookback period. On subsequent runs, it fetches only alarms created since the last successful poll. Alarm data is normalized via an ingest pipeline and stored in the incidents data stream.

The SOCRadar integration collects security alarm events from the following endpoint:

• GET /api/company/{company_id}/incidents/v4

Each event represents a single SOCRadar alarm and includes details such as risk level, alarm type, status, affected assets, and related entities.

• Centralized alarm visibility — View all SOCRadar alarms in Kibana Discover and the included dashboard.
• Risk-based triage — Alarm risk levels are mapped to ECS event.severity so alarms can be filtered and prioritized by severity.

• A valid SOCRadar API Key
• Your SOCRadar Company ID
• Elastic Agent installed on a host with network access to https://platform.socradar.com

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

1. In Kibana, go to Fleet → Integrations and search for SOCRadar.
2. Click Add SOCRadar.
3. Fill in the required fields:
   • API Key — Your SOCRadar API key.
   • Company ID — Your SOCRadar company ID (e.g., 330).
   • API URL — SOCRadar API base URL (default: https://platform.socradar.com).
   • Initial Lookback Period — How far back to fetch alarms on first run (e.g., 72h, 720h for 30 days).
   • Polling Interval — How often to poll for new alarms (default: 5m).
4. Click Save and continue.

After installation, open Kibana → Discover and filter by index logs-socradar_alert.incidents-*. Alarms should appear within one polling interval.

You can also open the SOCRadar dashboard from Kibana → Dashboards to verify data is flowing correctly.

For help with Elastic ingest tools, check Common problems.

• Confirm the Elastic Agent is running and has network access to https://platform.socradar.com.
• Check the agent logs in Fleet → Agents.
• Verify your API Key and Company ID are correct.

The integration polls the SOCRadar alarms endpoint once per Polling Interval (default 5m) and pages through the results using Records per page (default 100) until it reaches the last page.

• The first collection replays the whole Initial Lookback Period (default 72h, configurable up to 8760h). A large lookback issues many paged requests in a single cycle, so start with a smaller window if you are close to your SOCRadar API quota.
• Each alarm is indexed under a document ID derived from its alarm ID, so an alarm that is re-fetched (for example when a mid-pagination retry replays an earlier page) is rejected as a duplicate rather than indexed twice.
• Lower the polling interval only if your alarm volume justifies it; every collection cycle costs at least one API request.

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

The incidents data stream collects alarm events from the SOCRadar API.

{
    "@timestamp": "2024-02-03T08:15:42.000Z",
    "agent": {
        "ephemeral_id": "e417fc2e-6879-442d-8b6a-21c1cd4882a9",
        "id": "205fe089-c340-40d5-904b-59ed521ced73",
        "name": "elastic-agent-75436",
        "type": "filebeat",
        "version": "9.4.4"
    },
    "data_stream": {
        "dataset": "socradar_alert.incidents",
        "namespace": "default",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "205fe089-c340-40d5-904b-59ed521ced73",
        "snapshot": false,
        "version": "9.4.4"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "socradar_alert.incidents",
        "id": "a1b2c3d4-0000-0000-0000-000000000002",
        "ingested": "2026-08-05T13:34:27Z",
        "kind": "alert",
        "severity": 47
    },
    "host": {
        "architecture": "aarch64",
        "containerized": false,
        "hostname": "elastic-agent-75436",
        "ip": [
            "172.20.0.2",
            "172.19.0.5"
        ],
        "mac": [
            "16-13-EF-BE-B1-4F",
            "FE-97-B3-6B-81-76"
        ],
        "name": "elastic-agent-75436",
        "os": {
            "family": "",
            "kernel": "6.12.54-linuxkit",
            "name": "Wolfi",
            "platform": "wolfi",
            "type": "linux",
            "version": "20230201"
        }
    },
    "input": {
        "type": "cel"
    },
    "message": "Leaked credentials referencing your domain were found on a paste site.",
    "related": {
        "hosts": [
            "corp.example.org"
        ]
    },
    "socradar_alert": {
        "alarm_asset": "corp.example.org",
        "alarm_default_risk_level": "MEDIUM",
        "alarm_generic_title": "Leaked Credentials Detected",
        "alarm_id": "a1b2c3d4-0000-0000-0000-000000000002",
        "alarm_main_type": "Digital Risk Protection",
        "alarm_risk_level": "MEDIUM",
        "alarm_sub_type": "Credential Leak",
        "alarm_text": "Leaked credentials referencing your domain were found on a paste site.",
        "approved_by": "analyst",
        "company_id": 330,
        "date": "2024-02-03 08:15:42",
        "is_approved": true,
        "notification_id": 1002,
        "status": "RESOLVED",
        "tags": [
            "credential-leak"
        ]
    }
}

These inputs can be used with this integration:

To collect logs via API endpoint, configure the following parameters:

• API Endpoint URL
• API credentials (tokens, keys, or username/password)
• Request interval (how often to fetch data)

These APIs are used with this integration:

• GET /api/company/{company_id}/incidents/v4 — Fetches paginated alarm events. Supports start_date, page, limit, and include_alarm_details query parameters.

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.