Elastic Security

Index Cheqpoint approval events into Elasticsearch via the Bulk or Ingest API. Build Kibana dashboards over AI agent behaviour, configure Detection Engine rules, and correlate approvals with other security signals in Elastic SIEM.

1. Configure the Notification URL in Cheqpoint

text

Settings → Integrations → Elastic → Enter endpoint → Save

Elastic Ingest endpoint (Elasticsearch Service or self-hosted):
  https://<cluster-id>.es.<region>.aws.elastic-cloud.com/cheqpoint-approvals/_doc

Authorization: ApiKey <base64(id:api_key)>

Cheqpoint will POST each event as an Elasticsearch document.

2. Create an index with the right mappings

json

PUT /cheqpoint-approvals
{
  "mappings": {
    "properties": {
      "requestId":    { "type": "keyword" },
      "action":       { "type": "keyword" },
      "status":       { "type": "keyword" },
      "agentName":    { "type": "keyword" },
      "riskScore":    { "type": "float" },
      "decidedBy":    { "type": "keyword" },
      "decisionNote": { "type": "text" },
      "tags":         { "type": "keyword" },
      "createdAt":    { "type": "date" },
      "decidedAt":    { "type": "date" }
    }
  }
}

3. Cheqpoint event payload (indexed as-is)

json

{
  "requestId":    "req_01j3abc",
  "action":       "modify_user_permissions",
  "status":       "rejected",
  "agentName":    "IAM Bot",
  "riskScore":    0.88,
  "decidedBy":    "security-lead@company.com",
  "decisionNote": "Scope too broad - request scoped-down access instead",
  "tags":         ["SOX"],
  "createdAt":    "2026-10-15T09:12:00Z",
  "decidedAt":    "2026-10-15T09:13:05Z"
}

4. KQL query: high-risk actions (Kibana)

text

index: cheqpoint-approvals
query: riskScore > 0.7 and status: "rejected"

# Or as ES DSL:
GET /cheqpoint-approvals/_search
{
  "query": {
    "bool": {
      "must": [
        { "range": { "riskScore": { "gte": 0.7 } } },
        { "term":  { "status": "rejected" } }
      ]
    }
  }
}

5. Detection Engine rule: anomalous agent volume

json

{
  "name": "Cheqpoint: AI Agent Approval Volume Spike",
  "type": "threshold",
  "index": ["cheqpoint-approvals"],
  "query": "*",
  "threshold": {
    "field": ["agentName"],
    "value": 50
  },
  "from": "now-1h",
  "severity": "medium",
  "tags": ["AI Agent", "Cheqpoint"]
}

Recommended Kibana dashboards

Approval rate per AI assistant over time
High-risk action distribution (riskScore histogram)
Top rejected actions by action type
Reviewer response time percentiles (p50, p90, p99)
Regulatory tag coverage (EU AI Act / SOX / HIPAA events per day)