Sparta Elastic SIEM
Verify dataset freshness and reported retention, and optionally export minimized Sparta observations with a separate writer key.
Prepare scoped read access
This connector is available in customer v0.1.4 and current source-managed builds. Older v0.1.3 customer artifacts do not include it. Check release availability before creating keys.
Create a dedicated, expiring Elastic API key with read and view_index_metadata privileges only on the log streams under review. No cluster privileges are required by this connector. Limit the key and Sparta's index patterns to the same intended streams.
In Integrations → Elastic SIEM, enter the HTTPS Elasticsearch endpoint from Elastic Cloud and the key's encoded value. The Kibana browser URL is not the Elasticsearch API endpoint.
The current connector accepts an HTTPS origin ending in .elastic.cloud, without a path, explicit port, query or embedded credentials.
Configure expected datasets
In Settings, configure:
| Setting | Purpose |
|---|---|
| Log index patterns | Streams included in searches and lifecycle checks. Narrow the default logs-* to the reviewed scope. |
| Expected event datasets | Exact event.dataset values, one per line. List every expected feed explicitly. |
| Maximum event age | Maximum age of the latest event for each expected dataset; default 24 hours. |
| Minimum retention | Approved minimum reported retention; default 90 days. This check does not change retention. |
Connect, run the healthcheck and sync. Enable the relevant control sources and review the results.
An absent or quiet dataset requires review; a present dataset older than the configured limit fails the freshness check. A recent event does not establish complete coverage of every system or every event in the audit period.
The retention check reads data-stream lifecycle metadata. Missing or unrecognized effective retention requires review. An index managed through another lifecycle mechanism may need a separate policy review; the connector does not infer effective retention from an unreadable setting. Configuration does not prove historical availability or completed deletion.
Optional Sparta observation export
Use a separate writer key with only auto_configure and create_doc on these two streams:
logs-sparta.checks-default
logs-sparta.integration-defaultChoose an expiry consistent with your rotation policy. Keep the reader's privileges separate from the writer's. Enter the writer in Optional observation writer key and set Send Sparta observations to Enabled.
Check observations use event.dataset: sparta.checks and contain the check identifier, provider, status and timestamps. Integration observations use sparta.integration and contain provider connection state and last-sync time. Export excludes credentials, evidence payloads and raw vendor events.
Completed checks emit check observations. Elastic and cross-system checks also emit integration-state observations. Run a provider sync followed by an Elastic sync when verifying both kinds of record, and confirm they arrived in Elasticsearch.
Include these datasets in Expected event datasets only when observation export is enabled, and include their streams in the reader's scope if you expect Sparta to check them. Old failure observations remain in the history after a later recovery.
Configure native vendor feeds separately
This connection does not install Elastic Agent, configure vendor log delivery or provision a collector. Use each vendor's supported integration, poller or signed webhook for native security logs, with its own scoped credentials and plan entitlement.
A sparta.checks result for PostHog, Stripe or another provider is a Sparta observation. It is not that vendor's administrative audit event. Track restricted or unavailable feeds as coverage gaps and retain alert-triage evidence separately.
Control cost and retention
Review ingestion volume, retention, compute and any separate collector charges against your budget. Elastic's budget notifications do not enforce a spending limit. This connector neither changes your Elastic subscription nor enforces a monthly cost ceiling.