Type to search.

Data and context sources connectors

Use these connectors to retrieve additional data from third-party tools for your Elastic Security and agentic workflows.

Third-party search

  • Amazon EKS: Discover EKS clusters and node groups, scale node groups, manage cluster access entries, and mint Kubernetes tokens.

  • Amazon S3: List and download content from AWS S3 buckets.

  • Ansible Control Server: Launch and monitor Ansible Automation Controller / AWX jobs.

  • Argo CD: Manage GitOps applications in Argo CD — sync, inspect health and resources.

  • AWS CloudWatch: List and suppress alarms, query metrics and Logs Insights, and retrieve log events from AWS CloudWatch.

  • AWS X-Ray: Retrieve X-Ray insights, service graphs, and trace summaries and details for distributed tracing.

  • Azure Blob Storage: List containers and blobs, and retrieve blob content from Azure Blob Storage.

  • Azure Functions: Invoke HTTP-triggered functions, read function keys, and start, stop, or restart function apps.

  • Azure Kubernetes Service (AKS): List, inspect, and manage AKS clusters and node pools.

  • Azure Monitor: List and triage alerts, query metrics and logs, and control alert rules in Azure Monitor.

  • Azure SQL: Query tables, search rows, explore schema, and execute SQL in an Azure SQL Database.

  • BigQuery: Run GoogleSQL queries and retrieve results from Google BigQuery.

  • Bitbucket: Open, review, comment on, and merge pull requests, create branches, report commit build statuses, and trigger pipelines in Bitbucket Cloud.

  • Box: Search files and folders, read content, and query enterprise content using Box AI.

  • Brave Search: Search the web using the Brave Search API.

  • Buildkite: Trigger, observe, retry, and cancel builds, unblock deploy gates, and post annotations.

  • Confluence Cloud: Search and retrieve Confluence Cloud pages and spaces using the REST API v2.

  • Databricks: Execute SQL queries, discover tables and schemas, and poll async query results in Databricks.

  • Datadog: List and mute monitors, manage downtimes and incidents, post events, query metrics and logs, and start a workflow from a monitor webhook.

  • Dropbox: Search files and folders, retrieve file content and metadata, and manage shared links in Dropbox.

  • Dynatrace: Triage Davis problems, ingest events, query metrics and entities, and manage maintenance windows.

  • Elasticsearch: Search, index, and manage documents, retrieve mappings and aliases, and run ES|QL queries in Elasticsearch.

  • Firecrawl: Scrape, search, map, and crawl the web using the Firecrawl API.

  • Figma: Browse design files, inspect structure, render nodes as images, and explore team projects in Figma.

  • GitHub: Search code, issues, and pull requests, access repository contents and metadata, and start a workflow from repository webhooks.

  • GitLab: Search projects, manage issues and merge requests, browse repository files, and trigger CI/CD pipelines in GitLab.

  • Gmail: Search, read, label, quarantine, and send emails in Gmail.

  • Google Calendar: Search and access events and calendars in Google Calendar.

  • Google Cloud Monitoring: Find, silence, and snooze GCP alerting policies, and enrich alerts with metric, uptime, and SLO data.

  • Google Cloud Storage: Search and access objects in Google Cloud Storage buckets.

  • Google Drive: Search and access files and folders in Google Drive.

  • Google Kubernetes Engine: List clusters and node pools, scale and autoscale node pools, upgrade, roll back, and harden GKE clusters, and track the resulting operations.

  • Grafana: Read alerts and rules, manage silences, and post annotations.

  • GraphQL: Run queries and mutations, and introspect schemas on any GraphQL endpoint.

  • HubSpot: Search and retrieve contacts, companies, deals, and tickets from HubSpot CRM.

  • Jenkins: Trigger, monitor, and stop Jenkins builds, and manage jobs, test reports, and the build queue.

  • Jina Reader: Convert web pages into markdown from their URL and search the web for better LLM grounding.

  • Jira Cloud: Search issues with JQL, retrieve project and issue details, and look up users in Jira Cloud.

  • Kubernetes: Read and modify resources in a Kubernetes cluster through its REST API.

  • Microsoft Teams: Search messages and browse teams, channels, and chats in Microsoft Teams, and start a workflow from channel, chat, and team events.

  • Monday.com: Search boards, read and create items, post updates, and manage workspaces in Monday.com.

  • MongoDB: Query MongoDB collections using find, aggregate, count, and listCollections, and write with insertOne, updateOne, and deleteOne in workflows.

  • MySQL: Query tables, search rows, explore schema, and execute SQL in a MySQL database.

  • New Relic: Acknowledge and resolve AI issues, manage muting rules, and run NRQL queries.

  • Notion: Explore content and databases in Notion.

  • OneDrive: Search files and folders, browse drives, read file content, and list files shared with you in Microsoft OneDrive.

  • OpenSearch: Acknowledge and search alerts, run and manage monitors, handle Security Analytics detector alerts, and search and index documents.

  • Outlook: Search emails, list folders, and read messages and attachments in Microsoft Outlook.

  • PagerDuty: Access and manage incidents, escalation policies, schedules, on-calls, users, and teams in PagerDuty.

  • PostHog: Triage error-tracking issues, run HogQL queries, and control feature flags.

  • Prometheus: Run PromQL queries, and read, silence, and manage alerts and alert groups in Alertmanager.

  • Rootly: Declare and drive incidents through their lifecycle.

  • Salesforce: Query and retrieve data from your Salesforce org using SOQL and the REST API.

  • Sentry: Triage Sentry issues and provision issue alert rules.

  • ServiceNow: Search and retrieve records from ServiceNow, and start a workflow from incident, journal, and change-approval events.

    The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. You can also read, create, update, and delete records, incidents, and events in ServiceNow.

  • SharePoint online: Search across SharePoint sites, pages, and content using the Microsoft Graph API.

  • SharePoint Server: Search and retrieve documents, list items, folders, and site pages from an on-premises SharePoint Server instance.

  • Slack (v2): Search and send messages in Slack, and start a workflow from Slack events.

  • Snowflake: Query Snowflake, discover databases, schemas, tables, and views, and run semantic searches through Cortex Search.

  • SolarWinds Platform: Run SWQL queries, list, read, and acknowledge active alerts, and look up nodes.

  • Tavily: Search the web and extract content from web pages.

  • Trello: Search boards, lists, and cards, create and update cards, and post comments in Trello.

  • UniFi: Inventory UniFi Network sites, devices, clients, and networks, inspect UniFi Protect cameras and sensors, and restart devices or authorize guests.

  • Workday: Access Workday HR data across workers, org structure, time off, recruiting, and holidays.

  • Zabbix: Triage problems, manage maintenance windows, and enable or disable hosts and triggers.

  • Zendesk: Search and retrieve Zendesk tickets, users, organizations, and Help Center articles using the Zendesk API.

  • Zoom: Access Zoom meetings, recordings, transcripts, and participants.

Identity management

  • 1Password: Manage users in 1Password Enterprise Password Manager — list, get, suspend, and reactivate users.
  • Okta: Contain compromised identities — suspend users, revoke sessions, reset MFA, manage group membership, and query System Log events.
  • Google Cloud IAM: Disable service accounts, revoke leaked keys, and grant or revoke IAM role bindings.
  • Google Cloud Secret Manager: Inspect secrets, add and disable secret versions, and read access policy.

Email security

  • Sublime Security: Search flagged email, get verdicts, and quarantine, trash, or restore message groups in Sublime Security.

Threat intelligence

  • AbuseIPDB: Check IP reputation and report abusive IPs.
  • AlienVault OTX: Retrieve community-driven threat intelligence.
  • Censys: Enrich hosts, web properties, and certificates, submit assets for rescanning, and run CensEye threat-hunting jobs.
  • Google Threat Intelligence: Search threat collections and IOC streams, enrich IP, domain, URL, and file indicators, and scan URLs.
  • GreyNoise: Detect and classify Internet scanning noise.
  • MISP: Search attributes and events, check indicators and warninglists, and write sightings, events, attributes, and tags back to MISP.
  • Shodan: Perform Internet-wide asset discovery and vulnerability scanning.
  • ThreatQ: Search and enrich intelligence, update indicators, link objects, and run operations.
  • URLScan.io: Search historical URL scans, detonate a URL in a sandboxed browser, and retrieve verdicts, screenshots, and page content.
  • URLVoid: Check domain and URL reputation using multi-engine scanning.
  • VirusTotal: Perform file scanning, URL and domain analysis, result retrieval, and threat intelligence lookups.