Skip to main content

Elastic Cloud

Visualize Elastic Cloud Search Account, Users, Clusters, Nodes, Backup, Roles and Service Accounts changes through queries and alerts.

Installation​

The Elastic Cloud integration collects data from Elasticsearch deployments hosted on Elastic Cloud using the Elasticsearch REST API. It ingests cluster statistics, nodes, users, roles, service accounts, and snapshots. Before configuring the integration in JupiterOne, create an Elasticsearch API key with the required cluster privileges.

Prerequisites​

One instance is required per Elasticsearch deployment. The integration connects directly to the Elasticsearch endpoint using an API key.

The API key must have the following cluster privileges:

PrivilegeRequired for
monitorCluster statistics (/_cluster/stats) and node info (/_nodes)
read_securityUsers (/_security/user) and roles (/_security/role)
manage_service_accountService accounts (/_security/service)
monitor_snapshotSnapshots (/_snapshot/_all/_all)

See Cluster privileges in the Elasticsearch documentation for details.

Finding your Elasticsearch endpoint​

  1. Log in to the Elastic Cloud console.
  2. On the Hosted deployments page, select your deployment.
  3. Under Applications, locate the Elasticsearch entry and note the endpoint URL. It has the form https://<deployment-id>.<region>.<provider>.elastic-cloud.com:443.

Keep this URL — you will need it as the Elastic Search Endpoint when configuring JupiterOne.

Finding your Elastic Cloud Account ID​

  1. In the Elastic Cloud console, click your profile icon and select Organization.
  2. Copy the Organization ID.

Creating an Elasticsearch API key​

  1. From the Elastic Cloud console, open Kibana for your deployment (select Kibana under Applications on the deployment page).
  2. In Kibana, go to Stack Management > Security > API Keys (or search for "API Keys" in the global search bar).
  3. Click Create API key.
  4. Enter a descriptive name, such as JupiterOne.
  5. Optionally, set an expiration date.
  6. Under Control security privileges, set the following cluster privileges: monitor, read_security, manage_service_account, monitor_snapshot.
  7. Click Create API key.
  8. Copy the generated key — it is shown only once.

See Elasticsearch API keys in the Elastic documentation for additional guidance.

Configuration in JupiterOne​

To install the Elastic Cloud integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Elastic Cloud. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Elastic Cloud account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Elastic Cloud Account ID: Your Elastic Cloud organization ID, copied from the Organization page in the Elastic Cloud console.

  • Elastic Search API Key: The API key created in the previous step. This field is required.

  • Elastic Search Endpoint: The Elasticsearch endpoint URL for your deployment (for example, https://<deployment-id>.asia-south1.gcp.elastic-cloud.com:443). This field is required.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.