Skip to content

Creates content connectors page in security docs #2113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jul 31, 2025
Merged

Creates content connectors page in security docs #2113

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
51ab2e1
Creates content connectors page in security docs
benironside Jul 11, 2025
647937f
fixes broken attribute
benironside Jul 11, 2025
626ab8e
Apply suggestions from code review
benironside Jul 17, 2025
46d6836
Merge branch 'main' into 34-Elastic-Connectors-in-Security
benironside Jul 17, 2025
f3edea0
Update solutions/security/get-started/content-connectors.md
benironside Jul 17, 2025
6a6fb71
Merge branch 'main' into 34-Elastic-Connectors-in-Security
colleenmcginnis Jul 23, 2025
a73819a
Update content-connectors.md
benironside Jul 31, 2025
616bbdb
Merge branch 'main' into 34-Elastic-Connectors-in-Security
benironside Jul 31, 2025
a9df361
Apply suggestions from code review
benironside Jul 31, 2025
bb5900f
Merge branch 'main' into 34-Elastic-Connectors-in-Security
benironside Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions solutions/security/get-started/content-connectors.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
---
applies_to:
stack: preview 9.1
serverless: preview
---

# Content connectors
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

General remark, I haven't seen the new security UI, so consider adding a screenshot to this page if it would be helpful here, especially if it differs from previous generation of connector UIs


Elastic's content connectors allow you to extract, transform, index, and sync data from third-party applications including Github, PagerDuty, Jira, OpsGenie, Teams, Google Drive, Slack, email, and more. To see a complete list of the available connectors, follow the setup instructions below.

## Setup
{{stack}} supports two deployment methods: Elastic managed, and self-managed. {{sec-serverless}} only supports Elastic managed deployments. Self-managed deployments require you to manage the {{elastic-agent}} that forwards data to Elastic and allow you to customize the connector's code, whereas Elastic managed deployments use agentless technology and do not allow customization.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
{{stack}} supports two deployment methods: Elastic managed, and self-managed. {{sec-serverless}} only supports Elastic managed deployments. Self-managed deployments require you to manage the {{elastic-agent}} that forwards data to Elastic and allow you to customize the connector's code, whereas Elastic managed deployments use agentless technology and do not allow customization.
{{stack}} supports two deployment methods for your connectors: Elastic managed, and self-managed. {{sec-serverless}} only supports Elastic managed connectors. Self-managed connectors require you to manage the {{elastic-agent}} that forwards data to Elastic and allow you to customize the connector's code, whereas Elastic managed connectors use agentless technology and do not allow customization.

Suggestion to avoid confusion with stack deployment models

Reading this paragraph, I also wonder about what this page states: https://www.elastic.co/docs/reference/search-connectors/

"As of Elastic 9.0, managed connectors on Elastic Cloud Hosted are no longer available. All connectors must be self-managed."

If I reconcile this paragraph with the sentence from that other page, that gives:

  • Serverless only supports Elastic managed connectors
  • ECH only supports self-managed connectors
  • What about other Stack deployment types?

I think we should try to clarify, as I either misunderstood, or we're giving conflicting/partial information in our various pages.

@leemthompo maybe you can help here?

Copy link
Contributor

@leemthompo leemthompo Jul 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes https://www.elastic.co/docs/reference/search-connectors/elastic-managed-connectors will have to be updated because now managed connectors have been revived by the Sec/Obs teams.

You'll need to update this page to mention the availability of managed connectors in certain serverless projects and 9.1+ ECH Obs/Sec navs.

That page is currently accurate for 9.0.

In 9.0:

  • Serverless only supports self-managed connectors
  • ECH only supports self-managed connectors
  • What about other Stack deployment types? You can't run a managed connector on a self-managed deployment.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tldr is self-managed connectors can send data to Elasticsearch instances wherever they may be deployed

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Managed connectors only send data to the serverless/hosted deployment they're deployed within

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this paragraph belongs under Setup btw

Copy link
Contributor

@leemthompo leemthompo Jul 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Connectors have two deployment methods: Elastic managed and self-managed.

Self-managed deployments require you to deploy the connector service on your own infrastructure (i.e. run some Python code on a server you manage). When you use managed connectors Elastic runs that Python service for you within your deployment.

Self-managed connectors can be customized, whereas Elastic managed connectors cannot.

I think the serverless distinction is a bit nuanced:

  • You can use self-managed connectors to send data to Elasticsearch on serverless
  • AFAICT you can now use managed connectors for Obs/Sec projects


To learn about set up for self-managed connectors, refer to [Self managed connectors](elasticsearch://reference/search-connectors/self-managed-connectors.md). To set up an Elastic managed connector:
Copy link
Contributor

@leemthompo leemthompo Jul 31, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe make this into tabs, with Managed instructions as the first tab and link to self-managed instructions elsewhere


- Use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md) to find "Content conectors".
- Click **New Connector**.
- Under **Connector**, select your desired data source.
- Under **Setup**, select your deployment method.
- Under **Configure index & API key**, click **Generate configuration**. After a few seconds, this will create a new connector and a new index for its data, and display their names and IDs. You can click their names to view details about each.
- Click **Next** to continue to the **Configuration** page. This is where you can select details related to your specific data source. For more information about configuring your selected data source, follow the link on the left to the **Connector reference**.
- When configuration is complete, click **Next**. The **Finish up** page appears. Here you can set up recurring connector syncs, run a manual sync, or use queries and dev tools to interact with your data. Each sync updates the data in the connector's {{es}} index. You can also manage the connector.


## Manage a connector

To manage an existing connector:

- Use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md) to find "Content connectors".
- Click the connector you want to manage to open its settings page, which has six tabs:
- **Overview**: View general information such as the connector's name, ID, status, pipeline, and content sync history. Manage the connector's pipeline and attached index.
- **Documents**: View data from the connector.
- **Mappings**: Update index mappings for the connector's data.
- **Sync rules**: Use EQL to select which documents from the connector you wish to save. By default, all documents are saved.
- **Scheduling**: Define when data from this connector gets synced, and set up document level security. A `Full content sync` deletes existing data in your index before fetching from your data source again. An `Incremental content sync` fetches updated data only, without deleting existing data.
- **Configuration**: Edit the connector's data source-specific configuration.
1 change: 1 addition & 0 deletions solutions/toc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -474,6 +474,7 @@ toc:
- file: security/get-started/enable-threat-intelligence-integrations.md
- file: security/get-started/automatic-migration.md
- file: security/get-started/automatic-import.md
- file: security/get-started/content-connectors.md
- file: security/get-started/agentless-integrations.md
- file: security/get-started/agentless-integrations-faq.md
- file: security/get-started/spaces-elastic-security.md
Expand Down
Loading