Elastic Security × Sentiqra

Index structured Sentiqra results in Elastic for search, dashboards, alerting, and analyst workflows.

Why This Integration Matters

Elastic Security combines SIEM and endpoint security in a single platform. For organisations already running the Elastic Stack for log analytics, adding Sentiqra detections is a natural extension - but only if the ingestion path is documented.

By publishing an Elastic integration with ECS (Elastic Common Schema) field mappings, detection rules, and dashboard templates, SOC teams running Elastic can ingest Sentiqra detections without custom engineering.

Elastic's integration framework supports custom integrations via the Elastic Agent or Logstash, making Sentiqra detections available in Kibana Security dashboards alongside other security signals.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                Your Infrastructure                           │
│                                                               │
│  ┌──────────┐    ┌──────────────┐    ┌──────────┐           │
│  │ Sentiqra  │───▶│ Logstash /   │───▶│ Elastic  │           │
│  │ Detection │    │ Elastic      │    │ Search   │           │
│  │           │    │ Agent        │    │          │           │
│  │           │    │              │    │ Index:   │           │
│  │           │    │ ECS field    │    │ sentiqra │           │
│  │           │    │ mapping      │    │ -detections│          │
│  └──────────┘    └──────────────┘    └─────┬─────┘           │
│                                            │                   │
│                              ┌─────────────▼──────────┐       │
│                              │ Kibana Security        │       │
│                              │ - Detection rules      │       │
│                              │ - Dashboards           │       │
│                              │ - Timeline (SIEM)      │       │
│                              │ - Alerts               │       │
│                              └────────────────────────┘       │
└──────────────────────────────────────────────────────────────┘

Data flow: Sentiqra detection results are sent to Logstash or Elastic Agent via HTTP input → the pipeline maps Sentiqra fields to ECS (Elastic Common Schema) → events are indexed in Elasticsearch → Kibana Security displays detections in dashboards and the SIEM timeline → detection rules trigger alerts.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

# /etc/logstash/conf.d/sentiqra.conf
input {
  http {
    port => 8080
    codec => json
  }
}

filter {
  # Map Sentiqra fields to ECS
  mutate {
    rename => {
      "top_signal" => "[event][category]"
      "top_score" => "[event][risk_score]"
      "analyzer" => "[service][name]"
      "text_hash" => "[event][hash]"
    }
  }
  mutate {
    add_field => {
      "[event][module]" => "sentiqra"
      "[event][dataset]" => "sentiqra.detection"
    }
  }
}

output {
  elasticsearch {
    index => "sentiqra-detections-%{+YYYY.MM.dd}"
  }
}

import os, requests, hashlib

LOGSTASH_URL = "http://logstash.your-company.internal:8080"

response = requests.post(
    "https://sentiqra.tech/v1/analyze",
    headers={
        "Authorization": f"Bearer {os.environ['SENTIQRA_API_KEY']}",
        "Content-Type": "application/json",
    },
    json={"text": "click here to verify your account",
          "language": "en", "analyzers": ["cybersecurity"]},
    timeout=10,
)
data = response.json()
top = data["signals"][0] if data["signals"] else None

requests.post(LOGSTASH_URL, json={
    "request_id": "req_abc123",
    "analyzer": "cybersecurity",
    "text_hash": hashlib.sha256(b"click here to verify your account").hexdigest()[:16],
    "top_signal": top["code"] if top else None,
    "top_score": top["score"] if top else 0.0,
})

sequence by text_hash with maxspan=1h
  [ any where event.module == "sentiqra" and event.category == "phishing" ]
  [ any where event.module == "sentiqra" and event.category == "phishing" ]
  [ any where event.module == "sentiqra" and event.category == "phishing" ]
  // 3+ phishing detections for the same text hash within 1 hour

Security & Compliance Posture

• ✓
  NIS2 Article 21 - Incident Reporting: Elastic Security detections can provide timestamped evidence relevant to incident reporting obligations, with automated alerting via Elastic's detection engine.
• ✓
  ECS Compliance: Sentiqra fields are mapped to the Elastic Common Schema, ensuring interoperability with other security tools in the Elastic ecosystem.
• ✓
  SOC 2 Type II - CC7.2 - Monitoring: Kibana Security dashboards can support continuous monitoring of Sentiqra detection rates and confidence distributions.
• ✓
  Open Source: Elastic Stack is open source (Elastic License), allowing self-hosted deployments with no per-node licensing costs.
• ✓
  SIEM + Endpoint: Elastic Security combines SIEM and endpoint detection, so Sentiqra detections correlate with endpoint telemetry in the same platform.

Deployment Notes