Elastic Agent CCF Connector: Replacing Deprecated HTTP Collector API

What Changed

New CCF-based Data Connector for ElasticAgent v3.0.0, replacing the legacy HTTP Collector API implementation. The connector provides comprehensive system monitoring through Elasticsearch API integration.

Data Source

Ingests system metrics, logs, and telemetry data from Elastic Agent deployments via Elasticsearch Search API. Supports multiple data streams including CPU, memory, process, filesystem, network, load, uptime, agent metrics, and agent logs.

Ingestion Mechanism

CCF/DCR-based connector using API key authentication to query Elasticsearch indices. Data flows through Custom-ElasticAgentLogsV2_CL stream with DCR-based transformations for field normalization.

Detection Surface Unlocked

Provides visibility into:

• System performance metrics (CPU, memory, disk, network utilization)
• Process-level monitoring and resource consumption
• Agent health and telemetry data
• Error logs and operational events
• System load patterns (Linux environments)

The connector enables SOC teams to monitor infrastructure health, detect performance anomalies, and correlate system events with security incidents.

Affected Files

Solutions/ElasticAgent/Data Connectors/ElasticAgent_CCF/ElasticAgent_ConnectorDefinition.json
Solutions/ElasticAgent/Data Connectors/ElasticAgent_CCF/ElasticAgent_DCR.json
Solutions/ElasticAgent/Data Connectors/ElasticAgent_CCF/ElasticAgent_PollingConfig.json
Solutions/ElasticAgent/Data Connectors/ElasticAgent_CCF/table_ElasticAgentLogsV2.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, Solution_ElasticAgent.json, createUiDefinition.json, mainTemplate.json)