Elasticsearch Kibana Integration

The Censys for Elasticsearch Kibana connector adds the ability to:

• Enrich IPs, web properties, and certificates in Kibana with Censys Platform data.
• Initiate a Censys rescan of a host or web property.
• Retrieve event history for an IP address.
• Initiate a CensEye automated pivoting job to find assets related to an IP, web property, or certificate.

This guide walks through how to set up and use the Censys for Kibana integration.

Prerequisites

• Elastic Stack version 9.6.0 or higher.

• An Elastic admin role user with access to your instance.

• Your Censys Platform organization ID.

  • To obtain your organization ID:

    • Open the Platform web console and ensure that your organization account is selected. Go to Settings > Account Management > Personal Access Tokens.

    • The ID for your organization is shown in the "Current Organization" box. Click Copy to copy it to your clipboard.

      

• A Censys Platform Personal Access Token (PAT). Instructions on how to create and manage PATs are available in the API documentation.

Installation and configuration

1. In the Elastic admin console, go to Stack Management > Alerts and insights > Connectors.
2. Click Create connector. Locate and select Censys.
3. On the connector configuration panel:
   1. In the Connector name field, enter a name for your connector. Note the automatically generated connector ID for use in workflow steps.
   2. In the "Organization ID" field, enter your Censys organization ID.
   3. In the "API Token" field, enter your PAT.
4. Click Save.

Censys for Kibana actions

The Censys connector adds the following actions to Kibana.

Get Host

Retrieve comprehensive information about a host (IP address). Provides detailed intelligence about internet-facing infrastructure including services, ports, protocols, certificates, vulnerabilities, and location data.

Required input:

• host: An IPv4 or IPv6 address to retrieve information about.

Example workflow step

The following example retrieves all Censys data for the IP 8.8.8.8.

steps:
  - name: get_host
    type: censys.getHost
    connector-id: <your-connector-id>
    with:
      host: "8.8.8.8"

Get Host Enrichment

Retrieve a compact, SOC-optimized enrichment record for a host using its IP address. Returns a fixed subset of the latest scan data. Requires a Censys Core plan or higher. Core organizations are limited to 20,000 enrichment API calls per day. Organizations on the Censys Core + Unlimited Enrichment and Censys Security Operations plans can perform an unlimited number of enrichment API calls per day.

Required input:

• host: An IPv4 or IPv6 address to retrieve information about.

Example workflow steps

The following example retrieves all Censys data for the IP 1.1.1.1 and fall back to the Get Host action if the Get Host Enrichment action is unsuccessful.

steps:
  - name: get_host_enrichment
    type: censys.getHostEnrichment
    with:
      host: 1.1.1.1
    on-failure:
      continue: true
    connector-id: <your-connector-id>
  - name: fallback_to_get_host
    type: if
    condition: "{{ steps.get_host_enrichment.error != blank }}"
    steps:
      - name: get_host
        type: censys.getHost
        with:
          host: 1.1.1.1
        connector-id: <your-connector-id>

Get Web Property

Retrieve information about a web property using a specified hostname and port.

Required input:

• hostname: The hostname, domain, or IP address (IPv4 or IPv6).
• port: Port number (1 to 65535).

Example workflow step

The following example retrieves all Censys data for docs.censys.com:80 .

steps:
  - name: get_web_property
    type: censys.getWebProperty
    connector-id: <your-connector-id>
    with:
      hostname: docs.censys.com
      port: 80

Get Certificate

Retrieve information about a certificate by its SHA-256 fingerprint.

Required input:

• certificate: 64-character SHA-256 hex string.

Example workflow step

The following example retrieves all Censys data for the certificate bef4a41d69d4bea7b714be6a7bf3c496d561955a3ea3fdd29a511b46d8b19323 .

steps:
  - name: get_certificate
    type: censys.getCertificate
    connector-id: <your-connector-id>
    with:
      certificate: "bef4a41d69d4bea7b714be6a7bf3c496d561955a3ea3fdd29a511b46d8b19323"

Get Host History

Retrieve the chronological scan timeline for a host over a specified time window.

Required input:

• host : An IPv4 or IPv6 address.
• startTime : RFC3339 timestamp for the start of the window (for example, 2025-01-01T00:00:00Z).
• endTime : RFC3339 timestamp for the end of the window. The end time must be later than the start time (for example, 2025-01-31T23:59:59Z).

Example workflow step

The following example retrieves the scan history for 1.1.1.1 from 2025-01-01 through 2025-01-03.

steps:
  - name: get_host_history
    type: censys.getHostHistory
    connector-id: <your-connector-id>
    with:
      host: "1.1.1.1"
      startTime: "2025-01-01T00:00:00Z"
      endTime: "2025-01-03T23:59:59Z"

Rescan actions

Rescan

Submit a host service or a web property for a rescan. Returns a scan ID.

Required input:

• type: service to rescan a host service, or webproperty to rescan a web property.
• For service:
  • ip: IPv4 or IPv6 address.
  • port: Port number (1 to 65535).
  • protocol: Application-layer protocol on the service (for example, HTTP, SSH, TLS).
  • transportProtocol: one of unknown, tcp, udp, icmp, or quic.
• For webproperty:
  • hostname: Hostname, domain, or IP address (IPv4 or IPv6).
  • port: Port number (1 to 65535).

Get Scan Status

Poll the status of a rescan submitted via the Rescan action.

Required input:

• scanId : The scan ID returned by the Rescan.

Example workflow steps

The following example initiates a rescan of the HTTP service running on port 443 on 8.8.8.8 and re-fetch the host enrichment once the scan completes.

steps:
  - name: submit_rescan
    type: censys.rescan
    connector-id: <your-connector-id>
    with:
      type: service
      ip: 8.8.8.8
      port: 443
      protocol: HTTP
      transportProtocol: tcp

  - name: wait_for_scan
    type: wait
    with:
      duration: 3s

  - name: check_scan_status
    type: censys.scanStatus
    connector-id: <your-connector-id>
    with:
      scanId: '{{ steps.submit_rescan.output.result.tracked_scan_id }}'

  - name: refresh_host
    type: censys.getHost
    connector-id: <your-connector-id>
    with:
      host: 8.8.8.8

CensEye actions

To use the CensEye actions, your organization must have access to the Adversary Investigation module.

CensEye Create Analysis Job

Submit a CensEye analysis job for a host, web property, or certificate. Set type to the target asset type and provide the matching identifier or identifiers. Returns a jobID .

Required input:

• type: host, webproperty, or certificate.
• For host:
  • host : IPv4 or IPv6 address.
• For webproperty:
  • hostname: Hostname, domain, or IP address (IPv4 or IPv6).
  • port: Port number (1 to 65535).
• For certificate:
  • certificate: 64-character lowercase SHA-256 hex string.

CensEye Job Status

Poll the status of a CensEye job submitted via the CensEye Create Analysis Job action.

Required input:

• jobId: The job ID returned by CensEye Create Analysis Job.

CensEye Job Result

Retrieve the results of a completed CensEye job.

Required input:

• jobId: The job ID returned by CensEye Create Analysis Job.

Example workflow steps

The following example initiates a CensEye job for 8.8.8.8, checks its status, and retrieves the results.

steps:
  - name: create_censeye_job
    type: censys.censEyeCreateAnalysisJob
    connector-id: <your-connector-id>
    with:
      type: host
      host: 8.8.8.8

  - name: wait_for_job
    type: wait
    with:
      duration: 3s

  - name: check_job_status
    type: censys.censEyeJobStatus
    connector-id: <your-connector-id>
    with:
      jobId: '{{ steps.create_censeye_job.output.result.job_id }}'

  - name: get_job_results
    type: censys.censEyeJobResult
    connector-id: <your-connector-id>
    with:
      jobId: '{{ steps.create_censeye_job.output.result.job_id }}'