Endpoint & Elastic DB

[Swiftyyyy]

Hello everyone!

We've been aware of the possibility to push raw forensic data to an ELK stack for a little while now (through a sales representative meeting), but I've been unable to find any documentation on the topic.

Has anyone actually implemented this and do you find it at all useful?
We manage a number of environments and a good number of them use On-Prem Endpoint servers meaning we lack access to Threat Hunting. Being able to pipe these datasets into a database would potentially be a very good stopgap measure between something more official on the EDR front for On-Prem managed devices.

I ask because in the E86.50 agent release notes this functionality is explicitly mentioned.

Enterprise Endpoint Security E86.50 Windows Clients (checkpoint.com)

AHTP-24628

Forensics data can now be sent from the Endpoint's client computer directly to a local Elastic DB.