Atlassian Cloud Integration for Elastic

The Atlassian Cloud integration for Elastic enables collection of organization-wide audit log events from Atlassian Cloud products including Jira, Confluence, Bitbucket, Trello, and other Atlassian Cloud applications.

This integration polls the Atlassian Organizations REST API to collect administrative and security-relevant events such as user management, authentication, product access changes, organization policy updates, app/marketplace activity, and API token lifecycle events. The audit log captures activity across all Atlassian Cloud products in an organization in a unified format.

Elastic provides several Atlassian integrations. Choose the one that best fits your needs:

• Atlassian Cloud (this integration) — Collects organization-level audit events from the Atlassian Organizations API. Events span all Atlassian Cloud products (Jira, Confluence, Bitbucket, Trello, and others) in a single stream. Use this integration when you need unified visibility into organization-wide administrative activity such as SSO policy changes, cross-product user provisioning, marketplace app management, and domain verification. This integration is only available for Atlassian Cloud and does not support self-hosted deployments.

• Atlassian Jira (atlassian_jira) — Collects Jira-specific audit events from the Jira audit API. Use this integration when you need detailed Jira administrative activity such as permission scheme changes, project configuration updates, custom field modifications, and Jira-specific user and group management. This integration supports both Atlassian Cloud and self-hosted Jira Data Center deployments.

• Atlassian Confluence (atlassian_confluence) — Collects Confluence-specific audit events. Use this for detailed Confluence administrative activity.

• Atlassian Bitbucket (atlassian_bitbucket) — Collects Bitbucket-specific audit events. Use this for detailed Bitbucket administrative activity.

These integrations are complementary and can be used together. For example, you might use this integration for broad organization-level security monitoring while also using the Jira integration for deeper Jira-specific audit detail. Events from each integration are stored in separate data streams, so there is no conflict when running them side by side.

This integration is compatible with the Atlassian Cloud Organizations REST API v1, accessed via the /admin/v1/orgs/{orgId}/events-stream endpoint. Atlassian Cloud Organization admin access and an API key with the read:events:admin scope are required.

The integration polls the Atlassian Organizations API on a configurable interval using cursor-based pagination. Each poll cycle retrieves new audit events since the last successful poll, parses them, and ships the documents to Elasticsearch where the ingest pipeline maps fields to ECS and enriches them with categorization, related entities, and geo information.

The Atlassian Cloud integration collects organization-wide audit events of the following types:

• User management — invitations, deactivations, reactivations, removals.
• Authentication — logins, logouts, password changes, 2FA configuration.
• Product access — access grants, revocations, role changes.
• Organization policies — security policy updates, SSO configuration, domain verification.
• App / marketplace activity — app installations, uninstallations, access changes.
• API tokens — token creation and revocation.
• Group management — membership changes.
• Data security — data residency, classification policies.

This integration supports security monitoring, compliance reporting, and incident investigation across the full Atlassian Cloud organization. Common use cases include detecting suspicious authentication activity, tracking administrative changes, auditing user lifecycle events, monitoring third-party app installations, and correlating Atlassian admin activity with other security telemetry.

• An Atlassian Cloud Organization with admin access.
• An API key with the read:events:admin scope. See the Atlassian API key management documentation for creation steps.
• The Organization ID (UUID) of the Atlassian Cloud organization.
• Access to a Guard Premium or Cloud Enterprise plan might be required for full visibility into user-created activities.

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

Elastic Agent is required to poll the Atlassian Organizations REST API and ship the events to Elastic, where they will be processed via the integration's ingest pipelines.

1. In admin.atlassian.com, select your organization.
2. Navigate to Organization settings → API keys.
3. Choose API keys with scopes → Create API key.
4. Name the key (for example, Elastic Integration).
5. Set an expiration (maximum of 1 year). Plan for rotation before the key expires.
6. Select the read:events:admin scope, then create the key.
7. Copy and save the API key value — it is shown only once.
8. Note the Organization ID (UUID format) from the admin URL or organization settings.
9. In Kibana, add the Atlassian Cloud integration and configure it with the API URL (https://api.atlassian.com), Organization ID, and API key.

After configuration, verify that documents appear in the logs-atlassian_cloud.audit-* data stream within one or two polling intervals. The default polling interval is 5 minutes. Confirm that recent administrative actions (for example, a new API key creation) appear in the indexed events.

For help with Elastic ingest tools, check Common problems.

Common issues:

• 401 Unauthorized: verify the API key is current, has the read:events:admin scope, and was not revoked. API keys expire after at most 1 year.
• 403 Forbidden: verify the user that created the API key has Organization admin rights and that the Organization ID is correct.
• 429 Too Many Requests: the /events-stream endpoint enforces 50 requests/minute per API path and 60 requests/minute per user. Reduce polling frequency or batch size if rate limits are hit.
• Missing events: Atlassian Cloud audit log visibility depends on the organization's Atlassian plan. Guard Premium or Cloud Enterprise may be required for some user-created activities.

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

The audit data stream provides organization-wide audit events from Atlassian Cloud. Events cover user management, authentication, product access, organization policies, marketplace app activity, API token lifecycle, group membership changes, and data-security policy updates.

{
    "@timestamp": "2026-05-19T10:00:00.000Z",
    "agent": {
        "ephemeral_id": "bdf9e313-84d2-4672-8270-4424dcb3bb62",
        "id": "09e10f3c-9872-4052-a509-932f71f26f48",
        "name": "elastic-agent-22705",
        "type": "filebeat",
        "version": "9.3.2"
    },
    "atlassian_cloud": {
        "audit": {
            "message": {
                "format": "simple"
            }
        }
    },
    "data_stream": {
        "dataset": "atlassian_cloud.audit",
        "namespace": "23175",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "09e10f3c-9872-4052-a509-932f71f26f48",
        "snapshot": false,
        "version": "9.3.2"
    },
    "event": {
        "action": "user_login",
        "agent_id_status": "verified",
        "category": [
            "authentication"
        ],
        "created": "2026-05-19T10:00:01.000Z",
        "dataset": "atlassian_cloud.audit",
        "id": "a1000001-0000-4000-8000-000000000001",
        "ingested": "2026-05-20T11:03:06Z",
        "kind": "event",
        "module": "atlassian_cloud",
        "original": "{\"attributes\":{\"action\":\"user_login\",\"actor\":{\"email\":\"alice.johnson@example.com\",\"id\":\"712020:aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\",\"name\":\"Alice Johnson\"},\"location\":{\"city\":\"Example City\",\"countryName\":\"Example Country\",\"ip\":\"198.51.100.10\"},\"processedAt\":\"2026-05-19T10:00:01.000Z\",\"time\":\"2026-05-19T10:00:00.000Z\"},\"id\":\"a1000001-0000-4000-8000-000000000001\",\"message\":{\"content\":\"Alice Johnson logged in\",\"format\":\"simple\"},\"type\":\"events\"}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "Alice Johnson logged in",
    "observer": {
        "product": "Atlassian Cloud",
        "type": "saas",
        "vendor": "Atlassian"
    },
    "related": {
        "ip": [
            "198.51.100.10"
        ],
        "user": [
            "Alice Johnson",
            "alice.johnson@example.com"
        ]
    },
    "source": {
        "geo": {
            "city_name": "Example City",
            "country_name": "Example Country"
        },
        "ip": "198.51.100.10"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "atlassian_cloud-audit"
    ],
    "user": {
        "email": "alice.johnson@example.com",
        "id": "712020:aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
        "name": "Alice Johnson"
    }
}
		

These inputs can be used with this integration:

To collect logs via API endpoint, configure the following parameters:

• API Endpoint URL
• API credentials (tokens, keys, or username/password)
• Request interval (how often to fetch data)

These APIs are used with this integration:

• Atlassian Organizations REST API — Poll audit log events (/admin/v1/orgs/{orgId}/events-stream)

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.

← →

×

×