Replay Data with Cribl into Elastic Security and Isolate Hosts Using Elastic Agent

Receive a webhook from Elastic to initiate the creation of a SIEM case and link alerts. Analyze the IP, add location and enrichment data, query Elasticsearch for related hits, and decide whether to isolate the host.