Monitor Claude activity in Elastic Security

As more people across an organization start using Claude, security and compliance teams end up asking the same questions they ask about any other system: Who’s using it? How are they signing in? Who’s changing the configuration? Claude’s Compliance API answers all of that. It tracks more than 300 event types across Claude Enterprise, Claude Team, and Claude Platform, and every event arrives with the actor, a timestamp, and where it came from. The hard part was never the data. It’s getting that data into the workflows your SOC already runs and lining it up against everything else in your environment.

That’s exactly what Elastic’s Anthropic integration is for. It pulls Claude’s Compliance API events into Elastic Security: sign-ins, SSO and identity-provider changes, role and permission changes, the full API key lifecycle, data exports, MCP server connections, and plenty more. Once they’re in, you can search them, write detections against them, and investigate them right next to the telemetry you already collect.

In this post, we’ll walk through how the integration helps you:

• Ingest and normalize Claude Compliance API events

• Detect risky activity with detection rules

• Monitor Claude activity from a prebuilt dashboard

• Investigate Claude activity alongside your broader security telemetry

Because Claude events live in the same place as your identity, endpoint, cloud, and network data, you can investigate them in a single timeline instead of jumping between consoles. If someone creates an API key right after a sign-in your IdP flagged as suspicious, both events are sitting in the same platform. And if you see unusual file access in Claude activity, you can pull in the related endpoint or network data and work out whether it’s normal, a policy issue, or an actual incident.

Elastic Workflows handles the response from that same platform. A Claude event can kick off an investigation, add context to a case, or notify the right team, and you don’t need to stand up a separate SOAR to do any of it. That same data also doubles as a long-retention, searchable audit trail for compliance reviews and forensics.

Turn on the Compliance API and deploy the Anthropic integration, and then you can start monitoring Claude in Elastic Security. The Anthropic integration documentation has everything you need to get going.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, Elasticsearch, and associated marks are trademarks, logos or registered trademarks of elasticsearch B.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.