Elastic Fleet manual integration install

[GyciakasGh0st]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

12

Storage for /

250

Storage for /nsm

20

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Is is posible to manually install integrations from https://github.com/elastic/integrations/tree/main/packages
And how to do that ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[rh-ops]

You can find all of our currently supported integrations in our documentation here
https://docs.securityonion.net/en/2.4/third-party-integrations.html#supported-integrations

And the instructions on how to add these integrations can also be found in our documentation here
https://docs.securityonion.net/en/2.4/third-party-integrations.html#adding-an-integration

Some integrations will require you to open a respective port and allow the appropriate host to send data to Security Onion. Instructions on how to do that is found in our documentation here
https://docs.securityonion.net/en/2.4/firewall.html#creating-a-custom-host-group-with-a-custom-port-group

[wan0net]

So what if it's not a currently supported integration? How do we enable that?

I think some clarity on why SO manually chooses what integrations to enable would be helpful.

[reyesj2]

2.4.130 will contain all Elastic integrations

Previously integration support was added on an individual basis per customer & community requests