> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Elastic Security

> Connect Elastic Security to Myrmex over the Kibana API — create a user with the right role and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Elastic Security** deployment so Myrmex can run Kibana queries and API commands for threat auditing, detection-rule operations, and incident documentation. Myrmex reaches Kibana over **HTTPS** through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every query and command runs **live, on demand** — Myrmex returns only what you ask for and copies or stores nothing from Elastic on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Run Kibana queries" icon="magnifying-glass">
    Execute advanced Kibana and Elasticsearch queries to investigate activity — read-only for analysis.
  </Card>

  <Card title="Detection rule operations" icon="list-check">
    Review and, with write access, manage detection rules.
  </Card>

  <Card title="Threat auditing" icon="shield-halved">
    Audit signals and coverage to find gaps worth closing.
  </Card>

  <Card title="Document incidents" icon="file-lines">
    Capture findings and keep cases and [alerts](/documentation/detection-response/alerts) documented.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the Kibana host over HTTPS (commonly port `443` or your Kibana port such as `5601`). See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A **Kibana user** with read access for analysis, or read and write to manage detection rules and cases.
* The **Kibana Space** id, if your rules and cases live outside the default space.

## Step 1 — Create the Credential in Elastic Security

<Steps>
  <Step title="Create a role">
    In Kibana, go to **Stack Management → Security → Roles** and create a role with the index and Kibana **Security** privileges Myrmex needs — read for analysis, or read and write to manage rules and cases.
  </Step>

  <Step title="Create the user">
    In **Stack Management → Security → Users**, add a user, set a strong password, and assign the role. The field help describes this as an "Elastic Security user with read and write permission."
  </Step>

  <Step title="Note the Kibana space (optional)">
    If your detection rules and cases live in a non-default space, note its **Space id**; leave it blank for the default space.
  </Step>
</Steps>

<Tip>
  Assign a read-only role first. Add write privileges only when you want the agents to manage rules and cases for you.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Elastic Security**, then fill in:

| Field                     | Description                                                                                 |
| ------------------------- | ------------------------------------------------------------------------------------------- |
| **Name**                  | A unique name for this Elastic Security deployment.                                         |
| **Description**           | Optional note to identify the deployment.                                                   |
| **Protocol**              | Transport used to reach Kibana (use `https`).                                               |
| **URL**                   | Elastic Security API management interface IP or hostname with port (e.g. `127.0.0.1`).      |
| **Port**                  | The Kibana API port.                                                                        |
| **Authentication Method** | `basic` (username and password).                                                            |
| **Username**              | Elastic Security user with read and write permission.                                       |
| **Password**              | That user's password.                                                                       |
| **Collector**             | The [Collector](/documentation/agent-endpoint-security/collector-mode) that reaches Kibana. |
| **Kibana Space**          | Space id where rules and cases live (blank for default).                                    |

## Connect

Click **Connect** to validate the API connection and finish. Elastic Security then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  Use HTTPS with a valid certificate on Kibana. If Kibana runs behind a proxy, point the URL at the address the Collector can reach.
</Note>