---
title: Elastic Cloud Integration
description: The Elastic Cloud integration adds Elasticsearch mappings, an ingest pipeline, Kibana dashboards, and alerting rules for audit trail log delivery. The...
url: https://www.elastic.co/docs/reference/integrations/elastic_cloud
products:
- Elastic integrations
applies_to:
- Serverless Observability projects: Generally available
- Serverless Security projects: Generally available
- Elastic Stack: Planned
---
# Elastic Cloud Integration
| | |
|-------------------------------------------------------------------------------------------------|--------------------------------|
| **Version** | 1.0.0 ([View all](#changelog)) |
| **Subscription level**[What's this?](https://www.elastic.co/subscriptions) | Platinum |
| **Developed by**[What's this?](https://www.elastic.co/docs/reference/integrations/developed-by) | Elastic |
| **Minimum Kibana version(s)** | 9.6.0 |
## Overview
The Elastic Cloud integration adds Elasticsearch mappings, an ingest pipeline, Kibana dashboards, and alerting rules for [audit trail log delivery](https://www.elastic.co/docs/deploy-manage/monitor/log-delivery/audit-trail). The first data stream is **Serverless audit logs**. This package does not collect data with Elastic Agent.
Audit trail delivery writes project-level Elasticsearch and Kibana audit events to `logs-elastic_cloud.serverless_audit.otel-*` on an Elastic Security Serverless or Elastic Observability Serverless destination. The destination can be the same project as the source. You can read more about enablement, ignore filters, and example queries in [Audit trail log delivery](https://www.elastic.co/docs/deploy-manage/monitor/log-delivery/audit-trail).
### Compatibility
This integration requires Kibana 9.6.0 or later.
## What data does this integration collect?
- **Serverless audit**: project-level Elasticsearch and Kibana audit events delivered by Elastic Cloud Serverless.
The ingest pipeline copies the forwarded client IP to `client.ip` and adds GeoIP. If the lookup fails, the error is stored in `error.message`.
## What do I need to use this integration?
- An Elastic Security Serverless or Elastic Observability Serverless project as the destination
- Audit trail log delivery enabled on the source project
The package assets are already installed on the destination project. There is no Elastic Agent policy to configure.
## How do I deploy this integration?
This integration does not use Elastic Agent. Do not add it to an agent policy.
In Kibana on the destination project, open **Dashboards** and then **[Audit] Command Center**. Generate audit activity on the source project, such as signing in to Kibana or editing a dashboard, then confirm the panels on the destination populate.
This integration installs:
- Index templates for `logs-elastic_cloud.serverless_audit.otel-*`
- An ingest pipeline for the `elastic_cloud.serverless_audit` data stream
- Field mappings for the GeoIP enrichment of `client.ip`
- The **[Audit]** dashboards, saved searches, and visualizations
- Alerting rule templates for sign-in and location anomalies
## Alerting rules
The package installs the rule templates with its other assets. Add a rule from the Elastic Cloud integration **Assets** tab before it alerts.
Each rule reads `logs-elastic_cloud.serverless_audit.otel-*`. A sign-in success is an Elasticsearch `authentication_success` or a Kibana `user_login`. The identity is the email, otherwise the API key name, otherwise the user name. A Cloud API key stays distinct by realm. Platform accounts (`elastic/kibana`, `elastic/fleet-server`, `elastic.maintenance`, `autoscaling`, and `elasticsearch-controller`) are excluded.
- **[Elastic Cloud] Password guessing**: one identity fails to sign in at least 15 times in 10 minutes.
- **[Elastic Cloud] Password spray**: one client IP fails against at least 10 identities in 15 minutes.
- **[Elastic Cloud] Credential stuffing**: at least 30 failures, 10 identities, and 5 public IPs in 10 minutes.
- **[Elastic Cloud] Successful sign-in after repeated failures**: at least 5 failures, then a success, in 30 minutes.
- **[Elastic Cloud] Impossible travel**: two geolocated sign-ins at least 500 km apart, faster than 800 km/h or at the same moment, within 6 hours.
- **[Elastic Cloud] Sign-in from a new country**: a known identity uses a country it has not used in the last 7 days.
- **[Elastic Cloud] First-seen identity sign-in**: the first sign-in in 7 days. This rule stays quiet until the audit stream is at least 24 hours old.
- **[Elastic Cloud] Credential used from many places**: two countries in one hour, or an API key used from 3 public IPs.
Private, link-local, and carrier-NAT addresses are left out of the location rules, because those addresses do not geolocate.
## Troubleshooting
**No events in the dashboards**
- Make sure audit trail log delivery is enabled and sending to this destination project. See [Audit trail log delivery](https://www.elastic.co/docs/deploy-manage/monitor/log-delivery/audit-trail).
- Make sure documents are written to `logs-elastic_cloud.serverless_audit.otel-*`.
**Missing GeoIP fields**
Private and documentation-range addresses do not resolve. If the lookup fails, the error is stored in `error.message`.
## Reference
### Serverless audit
The `serverless_audit` data stream stores one audit event per document. The package adds `client.ip`, `client.geo.*`, and `error.message`. Other audit fields are mapped by the built-in OpenTelemetry templates.
#### Exported fields
| Field | Description | Type |
|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| client.geo.city_name | City name. | keyword |
| client.geo.continent_name | Name of the continent. | keyword |
| client.geo.country_iso_code | Country ISO code. | keyword |
| client.geo.country_name | Country name. | keyword |
| client.geo.location | Longitude and latitude. | geo_point |
| client.geo.region_iso_code | Region ISO code. | keyword |
| client.geo.region_name | Region name. | keyword |
| client.ip | IP address of the client (IPv4 or IPv6). | ip |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: * Must not contain `-` * No longer than 100 characters | constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| error.message | Error message. | match_only_text |
| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword |
### Inputs used
This package has no Elastic Agent inputs.
## Screenshots
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
![[Audit] Identity & Access](https://epr.elastic.co/package/elastic_cloud/1.0.0/img/audit_dashboard_identity.png)
![[Audit] Kibana Object Forensics](https://epr.elastic.co/package/elastic_cloud/1.0.0/img/audit_dashboard_kibana.png)
![[Audit] Elasticsearch Data Access](https://epr.elastic.co/package/elastic_cloud/1.0.0/img/audit_dashboard_elasticsearch.png)
## Changelog
| Version | Details | Minimum Kibana version |
|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|
| **1.0.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22222))Promote the Elastic Cloud integration to GA. | 9.6.0 |
| **0.1.4** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22211))Add alerting rules for password guessing, password spray, credential stuffing, a successful sign-in after repeated failures, impossible travel, a new country, a first-seen identity, and a credential used from many places, count Kibana user_login successes, ignore link-local and IPv6 unique-local addresses, tighten the sign-in, spray, and impossible-travel queries, document those rules in the README, and rename the Identity 360 dashboard asset to elastic_cloud-audit-identity-360. | 9.6.0 |
| **0.1.3** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22204))Add audit dashboard screenshots, rename Actor 360 to Identity 360, correct unusual-hour counts, travel lines, private-address labels, denied reads, and the cohort highlight, replace em dashes with hyphens in the audit dashboards, Discover sessions, and charts, and shorten the README so enablement and example queries stay in the audit trail documentation. | 9.6.0 |
| **0.1.2** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22081))Nullify unmapped api_key fields in Kibana queries and replace the audit logs search with an unfiltered event list. | 9.6.0 |
| **0.1.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22081))Query Kibana assets with ECS field names and add an audit logs saved search. | |
| **0.1.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/22081))Initial release of the Elastic Cloud integration with an assets-only serverless audit data stream. | |