Elastic Observability
Connect Elastic Observability to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Elastic Observability to collect observability evidence with automated compliance tests, switched on per workspace.
| Category | Observability |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Elastic Observability's guide | elastic.co |
Connect with an API token
-
In Elastic Observability:
- Elastic Cloud organization API key: from the navigation menu select Organization › API keys and click Create API key.
- In the flyout add a unique name, set the expiration, and assign roles.
- Click Create API key, copy the generated key and store it safely (you can also download it as a CSV file).
Elastic Observability's public documentation does not cover every step.
Source: elastic.co, checked 2026-10-07.
The permissions Safeguard needs:
Cloud Viewer,monitor,read_ilm,view_index_metadata (logs-*),Stack rules: Read. -
On Compliance › Connectors, open Elastic Observability, click Connect, choose API token and fill in:
Field What to enter API key (optional) Stored encrypted and never shown again. Instance URL (optional) An address under elastic-cloud.com. Or, instead: API key (optional), Instance URL (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Elastic Observability and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.2, CC6.2, CC6.3, CC7.2 | 6 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.13, A.8.15, A.8.16 | 6 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(b) | 6 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 10.4.1, 10.5.1 | 5 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, PR.AA-01, PR.AA-05, PR.DS-11, PR.PS-04 | 6 |
These tests are switched on per workspace by the Safeguard team.
Related
- Observability connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks