[New Integration] Anthropic audit logs

[P1llus]

Proposed commit message

This PR adds initial Anthropic Integration for their Compliance API. Includes support for their 300+ event types as defined in their API documentation: https://platform.claude.com/docs/en/api/compliance/activities/list

Initial audit log overview dashboard has been created and added as part of the integration as well.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Screenshots

[github-actions]

Vale Linting Results

Summary: 1 warning, 3 suggestions found

⚠️ Warnings (1)

File	Line	Rule	Message
packages/anthropic/data_stream/audit/fields/fields.yml	13	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.

💡 Suggestions (3)

File	Line	Rule	Message
packages/anthropic/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/anthropic/data_stream/audit/manifest.yml	12	Elastic.Ellipses	In general, don't use an ellipsis.
packages/anthropic/data_stream/audit/manifest.yml	12	Elastic.Ellipses	In general, don't use an ellipsis.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The Buildkite failure is a generated docs drift issue in Check integrations anthropic: the package docs README is out of date after changes to the audit sample event. Regenerate package docs and commit the updated packages/anthropic/docs/README.md.

Remediation

• Run: elastic-package build -v -c packages/anthropic (or the repo’s standard package build command) and commit regenerated docs.
• Re-run CI for Check integrations anthropic to confirm the README up-to-date check passes.

Investigation details

Root Cause

run_tests_package failed on the README consistency check, not on ingest pipeline/runtime logic. The failing step reports:

• README.md is outdated. Rebuild the package with 'elastic-package build'
• Error: checking package failed: checking readme files are up-to-date failed: files do not match

The referenced commit (7b76470f9542bdaa4d4cd93770e9b40025cfd0e3) changes packages/anthropic/data_stream/audit/sample_event.json only, which is consistent with generated doc snippets drifting when docs are not regenerated.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/43595
• Job/step: Check integrations anthropic
• Key log excerpt:
  • README.md is outdated. Rebuild the package with 'elastic-package build'
  • Diff includes regenerated event/sample fields (agent IDs/version, event.ingested, geo.location, etc.)
  • Error: checking package failed: checking readme files are up-to-date failed: files do not match

Verification

• Not run in this environment against the PR branch (local checkout is main), so findings are based on Buildkite logs + commit metadata.

Follow-up

If this recurs, consider adding a local pre-commit/check target for package doc regeneration before pushing.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• [New Integration] Anthropic audit logs #19174 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19174 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mrodm]

LGTM the changes related to .github/ISSUE_TEMPLATE folder

[P1llus]

Il add a comment here that while not enforced, it does require a team approval as well from @elastic/integration-experience

[P1llus]

Noted down a set of event categorization missmatches as well which I will resolve tomorrow

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[vinit-chauhan]

Hey @P1llus - I have added a couple of commits with updated ECS mappings (mainly event.category, event.type and event.outcome) for handful of activity_type. Let me know your thoughts.

[P1llus]

Outside of this, Vinit's changes LGTM :)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 8a60d92

History

• 💚 Build #43783 succeeded 680dab3
• 💚 Build #43738 succeeded 18d619b
• 💚 Build #43652 succeeded 02b44c2
• 💚 Build #43599 succeeded a5da42f
• 💔 Build #43595 failed 7b76470
• 💔 Build #43526 failed 5008b34

[elastic-vault-github-plugin-prod]

Package anthropic - 0.1.0 containing this change is available at https://epr.elastic.co/package/anthropic/0.1.0/