Elastic integration
Sync Elasticsearch users, roles, and access policies into your service intelligence layer for unified identity and security management.
What it connects
- Security users with assigned roles and account status across your Elasticsearch cluster.
- Role definitions including cluster permissions, index access levels, and application privileges.
- External identity mappings that connect LDAP, SAML, and SSO groups to roles for federated access.
- User metadata, email addresses, and full names for building a complete identity inventory.
What it automates
- Disable or enable user accounts in response to offboarding workflows or security incidents.
- Create new users and assign roles automatically during employee onboarding.
- Rotate and invalidate API keys when credentials are suspected compromised or rotated.
- Update role definitions and external identity mappings to sync permission changes across your system.
In practice
When a security investigation flags a suspicious API key in Elasticsearch, STLabs automatically revokes it and notifies the owning service team with incident context.
During employee offboarding. STLabs disables the user in Elasticsearch and cross-references their assigned roles to identify services that need similar access removal.
A SAML group policy change in your identity provider is detected; STLabs syncs the updated role mapping into Elasticsearch, ensuring federated users get consistent permissions everywhere.
STLabs correlates Elasticsearch audit logs with identity changes, flagging unusual permission escalations or role assignments that deviate from approval workflows.
