Threats_classifier filter plugin
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
- This plugin was created and is maintained by a partner.
- Change log
For plugins not bundled by default, it is easy to install by running bin/logstash-plugin install logstash-filter-threats_classifier. See Working with plugins for more details.
This plugin uses the cyber-kill-chain and MITRE representation language to enrich security logs with information about the attacker’s intent—what the attacker is trying to achieve, who they are targeting, and how they plan to carry out the attack.
Documentation for the filter-threats_classifier plugin is maintained by the creators.
This is a third-party plugin. For bugs or feature requests, open an issue in the plugins-filters-threats_classifier Github repo.