Monitoring and Protecting Claude's Activity with Elastic Security

Elastic Security Integrates Claude Monitoring for Operational Security

Elastic Security has introduced a new integration that allows monitoring Claude's activity, the AI-based operational security agent. This solution meets the security and compliance needs of organizations using Claude, providing tools to track who uses the system, how access occurs, and who modifies configurations.

Detailed Data and Real-Time Monitoring

Claude's Compliance API tracks over 300 types of events, including accesses, role and permission changes, API key lifecycle, data exports, and connections to MCP servers. Each event includes information about the user who performed it, a timestamp, and the source. However, the main challenge is not data collection but integrating it into the existing workflows of operational security (SOC) teams.

The integration of Elastic with Anthropic solves this problem by importing Claude's Compliance API events into Elastic Security. Once integrated, these events can be searched, analyzed, and investigated alongside other telemetry data already collected. This allows security teams to have a unified and comprehensive view of Claude's activity within their environment.

Ingestion and Normalization of Compliance Events

The integration of Elastic Security with Claude transforms each Compliance API event into structured fields aligned with the common Elastic Common Schema (ECS). These fields include information about the actor, the action and category of the event, the organization and project involved, the source IP address, and the affected resource. Thanks to this normalization, events are immediately searchable and can be analyzed with the same queries and correlations already used for other identity or cloud data.

Detection of Risky Activities with Detection Rules

Detection rules work on Claude events in the same way they work on cloud or identity data. By creating AI-based rules, you can describe in natural language what you want to detect and get a rule validated in Elasticsearch Query Language (ES|QL). For example, you can create a rule that alerts when a new MCP server connects outside an approved list or when there is a spike in failed access attempts for a single user.

Since Claude events reside alongside other telemetry data, rules can combine information from different sources. For example, the creation of an API key from an unknown IP address right after a suspicious event in the identity provider provides more comprehensive information than each event considered individually. Additionally, Attack Discovery triages Claude alarms along with all others, allowing the identification of broader attack chains.

Monitoring Claude Activity via Preconfigured Dashboards

The integration includes a series of preconfigured dashboards that allow you to start monitoring Claude's activity immediately after connecting the Compliance API. These dashboards allow filtering events by action, organization, project, and category, and provide a detailed overview of the activity.

Available information includes:

• Event metrics: Number of unique users, errors, and unique MCP servers, along with the total count of events over time, to detect spikes or unusual drops.
• Event count by type: Specific actions performed, such as access attempts, API key creation, role changes, connections of new MCP servers, or domain ownership requests.
• Top event categories: Mix of configuration, IAM, authentication, file, and web activities in the organization.
• Top MCP servers and skills: Tools and skills actually used, to easily identify new or unexpected MCP servers.
• Top users: Most active accounts by event count, useful for identifying outliers.

Joint Investigation with Existing Security Telemetry

Since Claude events reside in the same environment as other identity, endpoint, cloud, and network data, they can be investigated in a single timeline without switching between different consoles. For example, if a user creates an API key right after an access that the identity provider flagged as suspicious, both events are available on the same platform. Additionally, if an anomalous file access is detected in Claude's activity, endpoint or network data can be integrated to determine if it is normal behavior, a policy issue, or a real incident.

Elastic Workflows manages the response from the same platform. A Claude event can initiate an investigation, add context to a case, or notify the appropriate team, without the need to configure a separate SOAR system. These data can also be used as a long-term audit trail.

The Evolution of Endpoint Management

The integration with the runtime telemetry of Claude Code and Work opens new possibilities for endpoint monitoring. Administrators can now track not only which tools are used but also how they are used. This level of detail is crucial for identifying abnormal behaviors that may indicate malicious activity or violations of corporate policies.

Implications for API Management

The entire lifecycle of API keys, from creation to revocation, can be monitored in real time. This is particularly relevant in a context where APIs are increasingly at the center of corporate architectures. The ability to detect and respond quickly to suspicious changes in API keys significantly reduces the risk of abuse or data breaches.

The Importance of Training for IT Teams

To fully leverage the potential of this integration, it is essential that IT teams receive adequate training. Elastic offers specific resources, such as the post on monitoring Claude Code and Work, which can serve as a practical guide for configuring and optimizing the integration. Continuous training is crucial to keep skills aligned with technological developments.

Considerations on Scalability

The integration is designed to be scalable, adapting to the needs of organizations of different sizes. Whether it is a small security team or a complex IT department, the solution can be configured to handle an increasing volume of data without compromising performance. This scalability is a key factor for growing companies or with complex IT environments.

The Integration with Other Security Tools

Elastic Security easily integrates with other security tools already in use within the organization. This modular approach allows the creation of a cohesive security ecosystem, avoiding information silos that can hinder incident response. Integration with Elastic Workflows, for example, allows the automation of incident responses without the need to configure separate SOAR systems.

The Role of OpenTelemetry Telemetry

The use of OpenTelemetry for the runtime telemetry of Claude Code and Work represents a significant step forward. OpenTelemetry is an open standard for collecting and managing telemetry data, ensuring interoperability and flexibility. This technological choice facilitates integration with other tools and platforms, offering greater freedom of choice for organizations.

The integration between Elastic Security and Claude represents an important step forward in managing security and compliance. By offering a unified view of agent activities, this solution enables organizations to improve their incident detection and response capabilities, reduce investigation times, and ensure greater compliance with regulations. With proper configuration and continuous training, security teams can fully leverage the potential of this integration to effectively protect their IT environments.