New Analyzer: ElasticSearch Query

[nicpenning]

Feature description
Query any ElasticSearch cluster or multiple clusters for any field and any index and return common fields that use the ElasticSearch Common Schema (ECS)

Describe the solution you'd like
This analyzer allows you to quickly query for URLs, IP addresses, domains, file hashes, and whatever other observables you choose. It will be great for threat intelligence reports or searching for those IOCs from an in house analysis on a phishing campaign.

Features

• Query secured and insecure clusters
• Ability to add any index pattern to search
• Ability to add any field to search
• Ability to limit the amount of results to return
• Ability to extract observables
• Ability to add tags for amount of results that get returned

We are nearly complete with this analyzer. Just applying some finishing touches and then we can supply the Pull Request.

[nicpenning]

Thanks @nmprokop for this contribution!

[nadouani]

I've already seen this one during a demo, and it's definitely a very good job.

@nicpenning @nmprokop we will review it and see in which release we can ship it. I think that 3.0.0 scope is already closed.

[nicpenning]

Woohoo!

🔎🌲🪓🐝👌🚀🎉