Elastic Security
Connect Elastic Security to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Elastic Security to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.
| Category | Endpoint Detection & Response |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Elastic Security's guide | elastic.co |
Connect with an API token
-
In Elastic Security:
- In Kibana, open the API keys management page from the navigation menu or the global search field.
- Click Create API key and choose a user API key.
- Name the key for Safeguard and set an expiry date.
- Assign privileges that give read access only to Fleet, Integrations and Security (Safeguard's grants: Fleet: Read, Integrations: Read, Security: Read).
- Click Create API key and copy the key that is shown.
Where to find the other values:
- Instance URL: The https address you use to open Kibana for this deployment.
Elastic Security's public documentation does not cover every step.
The fetched Elastic pages confirm the API keys page, the Create API key button, an optional expiry and role/privilege assignment, but do not transcribe the exact Kibana feature-privilege labels for Fleet, Integrations and Security, the copy format, or whether the key is shown once. Elastic: any user with the manage_api_key or manage_own_api_key cluster privilege can create API keys. Where to read the Space ID in the UI was not sourced; leave it blank for the default space.
Source: elastic.co, elastic.co, checked 2026-10-07.
The permissions Safeguard needs:
Fleet: Read,Integrations: Read,Security: Read. -
On Compliance › Connectors, open Elastic Security, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. Your own server: an https address reachable from the internet. API key Required. Stored encrypted and never shown again. Space ID (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Elastic Security and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.8, CC7.2, CC7.3, CC7.4 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.26, A.8.1, A.8.7, A.8.16 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(5), 164.308(a)(6) | 5 |
| PCI DSS | Automated tests | 5.2.1, 5.3.1, 12.10.1 | 5 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.CM-09, PR.PS-01, RS.MI-02 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Endpoint Detection & Response connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks