> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch

> Connect an Elasticsearch cluster to Myrmex — create a read-only audit user and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Elasticsearch** cluster so Myrmex can audit its hardening and compliance, check its operational health, explore its indices, and — with approval — run queries for you. Myrmex reaches the cluster over its REST API through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Operations run live and on demand through the [Integration Specialist](/documentation/multi-agent-system/integration-specialist-agent) agent — Myrmex reads only what you ask for and keeps none of your data on the Myrmex side.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Compliance audit" icon="shield-halved">
    Run a [Security Posture](/documentation/security-posture/overview) audit and map findings to CIS, ISO 27001, NIST CSF, and BACEN [frameworks](/documentation/security-posture/frameworks).
  </Card>

  <Card title="Health checks" icon="heart-pulse">
    Review cluster health, shard allocation, and node resource use.
  </Card>

  <Card title="Explore indices" icon="table">
    List indices so you can see what the cluster holds.
  </Card>

  <Card title="Describe structure" icon="sitemap">
    Inspect an index's mappings, settings, and shards.
  </Card>

  <Card title="Sensitive-data scan" icon="user-secret">
    Scan indices and fields for personal or sensitive data that needs protection.
  </Card>

  <Card title="Run queries" icon="terminal">
    Run read queries any time; write operations require your confirmation.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** on a network that can reach the Elasticsearch host on its HTTP port (default `9200`). See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A **dedicated user** for Myrmex (create it in Step 1).
* **TLS** is recommended. Set Protocol to `https` where the cluster is TLS-enabled.

## Step 1 — Create the Credential in Elasticsearch

Create a dedicated, least-privilege role and user for auditing. Cluster `monitor` and `read_security` cover health, settings, and security configuration; `view_index_metadata` exposes index settings and mappings. Run the calls below (via the Dev Tools console or the REST API).

```json theme={null}
// Create a read-only audit role
POST /_security/role/myrmex_audit
{
  "cluster": ["monitor", "read_security"],
  "indices": [
    { "names": ["*"], "privileges": ["monitor", "view_index_metadata"] }
  ]
}

// Create the user and assign the role
POST /_security/user/myrmex_audit
{
  "password": "a-strong-password",
  "roles": ["myrmex_audit"]
}
```

<Tip>
  Keep the role read-only for auditing. Add `read` on the target indices only if you want the agents to query documents, and grant write privileges only for confirmation-gated **Run queries** operations.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Elasticsearch**, then fill in:

| Field           | Description                                                                                            |
| --------------- | ------------------------------------------------------------------------------------------------------ |
| **Name**        | A unique name for this cluster.                                                                        |
| **Description** | Optional note to identify the instance.                                                                |
| **Host**        | Elasticsearch host or IP.                                                                              |
| **Port**        | Elasticsearch HTTP port (default `9200`).                                                              |
| **Username**    | Elasticsearch username.                                                                                |
| **Password**    | Elasticsearch password (stored encrypted).                                                             |
| **Protocol**    | Protocol for the REST API: `https` (recommended) or `http`.                                            |
| **Collectors**  | The [Collector(s)](/documentation/agent-endpoint-security/collector-mode) that can reach this cluster. |

## Connect

Click **Connect** to validate the login and protocol. The cluster then appears under **Environment → Integrations** alongside your other [integrations](/documentation/integrations/overview), and you can start asking the AI about it in the Workspace.

## Notes

* **Read-only by default.** Auditing, health, exploration, and sensitive-data scans only need the read-only role above. Add write privileges only if you want confirmation-gated **Run queries** operations.
* **Nothing is stored.** Every operation runs in real time through the Collector; results return to your Workspace and no cluster data is retained on the Myrmex side.
* **TLS.** Prefer `https`; the posture audit flags a cluster served over plain `http`.