Elastic Security integration candidate

Verified exposure alerts, shaped for Elastic Security

Elastic Agent pulls a dedicated ECS feed. LeakData rechecks address eligibility, source verification, severity, and entitlement before every alert leaves the platform.

Status
Candidate package; not yet in the Elastic Package Registry.
LeakData access
Enterprise with SIEM integration access.
Provider
Fleet-managed Elastic Agent and a compatible Kibana version; request the candidate package before setup.
Configure in dashboard Read Elastic integration docs

Privacy boundary active

01

How findings are verified

  1. 01

    Prove ownership

    Only an exact personal email that is ownership-verified or on one of your verified domains is eligible.

  2. 02

    Verify the source

    Every represented source must be explicitly verified and meet the current threshold.

  3. 03

    Recheck on delivery

    LeakData reloads entitlement, monitor, scan, and source state on every feed request.

  4. 04

    Publish minimal ECS

    Elastic receives classification, opaque ID, count, severity, and verification scope only.

Included in each alert

  • Opaque deterministic event ID
  • Verified finding count
  • Configured and highest severity
  • ECS classification and rule metadata
  • Explicit no-personal-data marker

Deliberately excluded

  • Email addresses or names
  • Monitor or source identifiers
  • Breach names or source URLs
  • Credentials, passwords, hashes, or values
  • Raw records and event.original
02

Connector setup

  1. 1

    Create the connector in LeakData and copy the token once.

  2. 2

    Request the candidate package from LeakData support, then install it in Fleet using the supplied instructions.

  3. 3

    Keep https://leakdata.io and store the token as a Fleet secret.

  4. 4

    Confirm alerts in logs-leakdata.exposure-* before enabling detections.

Request candidate package

Accurate package status

Version 0.1.0 is a submission candidate. It is not represented as Elastic-reviewed, approved, or published in the Elastic Package Registry until the official review and merge are complete.