elastic · vinit-chauhan · Jun 22, 2026 · Jun 19, 2026 · Jun 22, 2026 · Jun 22, 2026
@@ -3,7 +3,7 @@
 
 ## Overview
 
-The Anthropic integration collects compliance activity audit logs from [Anthropic](https://www.anthropic.com) organizations. Enterprise, Team, and Claude Platform organizations generate audit events for security-relevant activities such as user authentication, organization administration, role and permission changes, API key lifecycle, Claude.ai and Claude Code usage, MCP server configuration, billing updates, and Compliance API access. This integration enables security and compliance teams to monitor administrative activity, detect unauthorized changes, and maintain an audit trail of organization operations in Elasticsearch and Kibana.
+The Anthropic integration collects compliance activity logs from [Claude's Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api). Claude Enterprise, Team, and Claude Platform organizations generate audit events for security-relevant activities such as user authentication, organization administration, role and permission changes, API key lifecycle, Claude.ai and Claude Code usage, MCP server configuration, billing updates, and Compliance API access. This integration enables security and compliance teams to monitor administrative activity, detect unauthorized changes, and maintain an audit trail of organization operations in Elasticsearch and Kibana.
 
 ### Compatibility
 
@@ -82,6 +82,14 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
 
 Elastic Agent polls the Anthropic Compliance API and ships collected events to Elasticsearch, where they are processed by the integration's ingest pipeline.
 
+### Agentless deployment
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Refer to [Agentless integrations](https://www.elastic.co/docs/reference/fleet/agentless-integrations) for more information.
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the underlying agent infrastructure.
+
+To use an agentless deployment, select **Anthropic** in **Management → Integrations**, click **Add Anthropic**, and choose the agentless option when configuring the integration. Provide the Compliance Access Key or Admin API Key as described in [Onboard / configure](#onboard--configure); Elastic manages the underlying collection infrastructure for you.
+
 ### Onboard / configure
 
 Complete the Anthropic-side setup before deploying — request Compliance API access and create an API key with the `read:compliance_activities` scope. See [Get access to the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) for key types, scope details, and rotation guidance.

@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "1.0.0"
+  changes:
+    - description: Promote the Anthropic integration to GA.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/19668
+    - description: Remap `anthropic.audit.updates` from `keyword` to `flattened` to match the array-of-objects, and update description in manifest and README file.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/19668
 - version: "0.2.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.

@@ -554,11 +554,20 @@ processors:
       field: json.from_date
       ignore_missing: true
       tag: remove_json_from_date
-  - rename:
+  - convert:
       field: json.github_webhook_id
       target_field: anthropic.audit.github_webhook_id
+      type: string
+      ignore_missing: true
+      tag: convert_github_webhook_id
+      description: >-
+        The Compliance API returns the GitHub-assigned webhook ID as a number,
+        but it is stored as a keyword identifier.
+  - remove:
+      field: json.github_webhook_id
       ignore_missing: true
-      tag: rename_github_webhook_id
+      tag: remove_json_github_webhook_id
+      if: ctx.json?.github_webhook_id != null && ctx.anthropic.audit.github_webhook_id != null
   - rename:
       field: json.group_id
       target_field: anthropic.audit.group_id

@@ -241,7 +241,7 @@
       description: Lower bound of the date window referenced by the activity payload (for example, an audit log export's `from_date`).
     - name: github_webhook_id
       type: keyword
-      description: Github webhook id as reported in the activity payload.
+      description: GitHub-assigned webhook ID returned by the activity payload. The Compliance API returns this as a number; it is stored as a keyword identifier.
     - name: group_id
       type: keyword
       description: Group id as reported in the activity payload.
@@ -357,7 +357,7 @@
       type: keyword
       description: Org id as reported in the activity payload.
     - name: per_review_limit_usd
-      type: long
+      type: keyword
       description: Per review limit usd as reported in the activity payload.
     - name: plan_type
       type: keyword
@@ -510,8 +510,8 @@
       type: keyword
       description: Trigger mode as reported in the activity payload.
     - name: updates
-      type: keyword
-      description: Updates as reported in the activity payload.
+      type: flattened
+      description: Array of setting-change objects on `*_updated` activities, each with `type`, `previous_value`, and `current_value` as reported in the activity payload.
     - name: value
       type: long
       description: Value as reported in the activity payload.

@@ -4,7 +4,7 @@
 
 ## Overview
 
-The Anthropic integration collects compliance activity audit logs from [Anthropic](https://www.anthropic.com) organizations. Enterprise, Team, and Claude Platform organizations generate audit events for security-relevant activities such as user authentication, organization administration, role and permission changes, API key lifecycle, Claude.ai and Claude Code usage, MCP server configuration, billing updates, and Compliance API access. This integration enables security and compliance teams to monitor administrative activity, detect unauthorized changes, and maintain an audit trail of organization operations in Elasticsearch and Kibana.
+The Anthropic integration collects compliance activity logs from [Claude's Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api). Claude Enterprise, Team, and Claude Platform organizations generate audit events for security-relevant activities such as user authentication, organization administration, role and permission changes, API key lifecycle, Claude.ai and Claude Code usage, MCP server configuration, billing updates, and Compliance API access. This integration enables security and compliance teams to monitor administrative activity, detect unauthorized changes, and maintain an audit trail of organization operations in Elasticsearch and Kibana.
 
 ### Compatibility
 
@@ -83,6 +83,14 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
 
 Elastic Agent polls the Anthropic Compliance API and ships collected events to Elasticsearch, where they are processed by the integration's ingest pipeline.
 
+### Agentless deployment
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Refer to [Agentless integrations](https://www.elastic.co/docs/reference/fleet/agentless-integrations) for more information.
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the underlying agent infrastructure.
+
+To use an agentless deployment, select **Anthropic** in **Management → Integrations**, click **Add Anthropic**, and choose the agentless option when configuring the integration. Provide the Compliance Access Key or Admin API Key as described in [Onboard / configure](#onboard--configure); Elastic manages the underlying collection infrastructure for you.
+
 ### Onboard / configure
 
 Complete the Anthropic-side setup before deploying — request Compliance API access and create an API key with the `read:compliance_activities` scope. See [Get access to the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) for key types, scope details, and rotation guidance.
@@ -195,7 +203,7 @@ The `audit` data stream collects compliance activity events from the Anthropic C
 | anthropic.audit.folder_id | Folder id as reported in the activity payload. | keyword |
 | anthropic.audit.from_date | Lower bound of the date window referenced by the activity payload (for example, an audit log export's `from_date`). | date |
 | anthropic.audit.ghe_configuration_id | GitHub Enterprise configuration ID on GHE integration activities. | keyword |
-| anthropic.audit.github_webhook_id | Github webhook id as reported in the activity payload. | keyword |
+| anthropic.audit.github_webhook_id | GitHub-assigned webhook ID returned by the activity payload. The Compliance API returns this as a number; it is stored as a keyword identifier. | keyword |
 | anthropic.audit.group_id | Group id as reported in the activity payload. | keyword |
 | anthropic.audit.group_name | Group name as reported in the activity payload. | keyword |
 | anthropic.audit.idp_saml_config_updated | Idp saml config updated as reported in the activity payload. | boolean |
@@ -240,7 +248,7 @@ The `audit` data stream collects compliance activity events from the Anthropic C
 | anthropic.audit.op_name | Op name as reported in the activity payload. | keyword |
 | anthropic.audit.org_id | Org id as reported in the activity payload. | keyword |
 | anthropic.audit.organization_uuid | Deprecated organization UUID associated with the activity, when present. | keyword |
-| anthropic.audit.per_review_limit_usd | Per review limit usd as reported in the activity payload. | long |
+| anthropic.audit.per_review_limit_usd | Per review limit usd as reported in the activity payload. | keyword |
 | anthropic.audit.plan_type | Plan type as reported in the activity payload. | keyword |
 | anthropic.audit.plugin_id | Plugin id as reported in the activity payload. | keyword |
 | anthropic.audit.plugin_name | Plugin name as reported in the activity payload. | keyword |
@@ -300,7 +308,7 @@ The `audit` data stream collects compliance activity events from the Anthropic C
 | anthropic.audit.token_name | Token name as reported in the activity payload. | keyword |
 | anthropic.audit.tool_name | Tool name as reported in the activity payload. | keyword |
 | anthropic.audit.trigger_mode | Trigger mode as reported in the activity payload. | keyword |
-| anthropic.audit.updates | Updates as reported in the activity payload. | keyword |
+| anthropic.audit.updates | Array of setting-change objects on `\*_updated` activities, each with `type`, `previous_value`, and `current_value` as reported in the activity payload. | flattened |
 | anthropic.audit.value | Value as reported in the activity payload. | long |
 | anthropic.audit.version | Version as reported in the activity payload. | keyword |
 | anthropic.audit.webhook_id | Webhook ID on webhook lifecycle activities. | keyword |

@@ -1,10 +1,10 @@
 format_version: "3.4.2"
 name: anthropic
 title: Anthropic
-version: "0.2.0"
+version: "1.0.0"
 source:
   license: "Elastic-2.0"
-description: Collect compliance activity audit logs from Anthropic with Elastic Agent.
+description: Collect activity logs from Claude's Compliance API.
 type: integration
 categories:
   - security
@@ -31,7 +31,7 @@ icons:
 policy_templates:
   - name: anthropic
     title: Anthropic logs
-    description: Collect compliance activity audit logs from Anthropic.
+    description: Collect activity logs from Claude's Compliance API.
     deployment_modes:
       default:
         enabled: true
@@ -44,7 +44,7 @@ policy_templates:
     inputs:
       - type: cel
         title: Collect Anthropic compliance activity logs
-        description: Collect compliance activity audit logs from the Anthropic Compliance API.
+        description: Collect activity logs from Claude's Compliance API.
 owner:
   github: elastic/integration-experience
   type: elastic