← All integrationsINTEGRATION · SECURITY OPERATIONS

Kapālins for Elastic

Your SOC keeps working in Elastic Security and Elasticsearch, on Elastic Cloud or self-managed. Kapālins sends every AI finding, block and incident there through the Elasticsearch _bulk API, one Elastic Common Schema document per finding, into a data stream your detection rules query by name, with the person, the rule and what was stopped on each one.

See it governed liveSetup in four steps

No new console for the SOC

Analysts triage AI findings in Elastic, next to everything else, in its own field names.

AI-specific signal you do not have today

Prompt injection, sensitive data in prompts, unapproved models and agent tool calls, mapped to MITRE ATLAS before they arrive.

Every push on record

Each push is logged with Elastic’s response, and the integration shows the last error until the next push succeeds.

WHAT ARRIVES

What lands in Elastic.

Each event carries its severity, the person, the rule that fired, what was stopped and the Kapālins event id, so the evidence is one search away. Every verdict is sent as it happens; your rules and searches decide what becomes an alert.

  • Sent through the Elasticsearch _bulk API, one Elastic Common Schema document per finding, into a data stream your detection rules query by name
  • Credential: an API key allowed to write to that data stream, and your Elasticsearch endpoint
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
CONTEXT

Mapped to the attack. Priced in dollars.

Every finding carries the MITRE ATLAS technique it belongs to and the plane that caught it. Click the technique and Kapālins shows its residual risk and a modelled annual loss, so the SOC can rank AI findings by what they could cost.

  • Bayesian FAIR on your own telemetry, labelled as modelled
  • Prompt injection, jailbreak, tool misuse, data exfiltration
Kapālins Threat Map: a MITRE ATLAS technique opened to its modelled loss exposure
Console replay · illustrative data
A replay of the Kapālins console: posture, the MITRE ATLAS matrix, then one technique opened to its residual risk and a modelled annual loss from Bayesian FAIR with sector priors. Loss figures are modelled; key names are illustrative.
SOURCE

Everything behind the finding.

The full record stays in Kapālins: the request, the verdict and the rule, so an analyst in Elastic can pivot to the evidence.

  • Nothing is pulled from Elastic
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
Setup

Four steps.

  1. Create the destination credentialAn API key allowed to write to that data stream, and your Elasticsearch endpoint, created in Elastic.
  2. Add the destinationMy Integrations › Security operations › Elastic: paste the credential and endpoint. The connect page shows where to find each one.
  3. Send a testKapālins sends a test event and shows Elastic’s response; Connect unlocks when it passes.
  4. Watch the first events landEvery verdict from then on is sent as it happens, and each push is in the integration’s history.
Request a briefing

See Elastic governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins read anything from Elastic?

No. The integration is one-way: Kapālins pushes, nothing is pulled.

Which findings are sent?

Every verdict, as it happens, so Elastic holds the full record. Your own rules and searches decide what becomes an alert.

What if a push fails?

The attempt and Elastic’s response are recorded in the push log, and the integration shows the error until the next push succeeds.