Elastic and Axonius integrate to deliver unified asset intelligence for security teams

The Axonius integration supports both agent-based and agentless deployments. Agentless ingestion is supported on Elastic Cloud Serverless and Elastic Cloud Hosted, which reduces the operational overhead of maintaining and managing dedicated agents and the underlying infrastructure to support them. 

The Axonius integration periodically queries Axonius APIs and writes normalized documents into Elasticsearch across several data streams. Each stream represents a distinct category of asset intelligence, and together, they fill gaps that traditional agent-based telemetry alone can’t cover.

This is the richest data stream for security analysts. Rather than a single endpoint, it aggregates across Axonius's full application surface: installed software, SaaS applications, licenses, browser extensions, audit activity, business application metadata, secrets, and URLs spanning both managed and unmanaged territory. 

Key fields include audit_activities (actions like login, create, update, delete, reset_password tied to specific users and applications), extension metadata differentiating IT-deployed versus user-installed tooling, and SaaS footprint data across your identity and application landscape.

User records are normalized to ECS user.* fields. Because Axonius aggregates across HR systems, directories, SaaS platforms, and security tools, these records frequently surface accounts not visible through any single source like orphaned identities, service accounts, or users present in one system but absent in another.

These vulnerability-oriented events with CVE and CVSS fields are mapped to ECS vulnerability.*. Exposure data reflects what's been correlated across your connected tools, meaning the same CVE can be tied to asset ownership, business criticality, and control coverage in the same record.

Incidents and findings from connected tools, including cloud workload alerts, adapter health failures, and platform-level findings, are enriched with severity, recommendation text, and MITRE-oriented labels where applicable. These records are tagged event.kind: alert, making them compatible with Elastic detection rule workflows. 

Cloud and object storage assets, ITSM tickets with status and priority timelines, adapter connection health, and gateway metadata are also included. The adapter health stream (axonius.adapter) is worth particular attention as it indicates when a data source goes silent, which is often the first signal that coverage has drifted.

Elastic Workflows can automate asset enrichment so that every Elasticsearch Query Language (ES|QL) query runs against a live, pre-built lookup index, removing manual lookups and tool switching. Workflows periodically searches the Axonius asset data and writes it to a dedicated index set to lookup mode. That lookup index can then be referenced in ES|QL queries to enrich logs and alerts with asset context on the fly, correlating events with attributes like device owner, business unit, or risk score without any manual lookups.

When threat hunting or working an investigation, raw log data can’t tell you who owns a device, what software is running on it, and whether it meets compliance baselines. Axonius supplies that context.

Here’s an example ES|QL query enriching context from Axonius asset data onto failed authentication events using the lookup index created by the workflow.