{
  "name": "claude_code",
  "title": "Claude Code",
  "version": "0.2.0",
  "release": "beta",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Collect Claude Code agentic telemetry via OpenTelemetry.",
  "type": "integration",
  "download": "/epr/claude_code/claude_code-0.2.0.zip",
  "path": "/package/claude_code/0.2.0",
  "icons": [
    {
      "src": "/img/claude-logo.svg",
      "path": "/package/claude_code/0.2.0/img/claude-logo.svg",
      "title": "Claude logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^9.4.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "opentelemetry"
  ],
  "signature_path": "/epr/claude_code/claude_code-0.2.0.zip.sig",
  "format_version": "3.6.0",
  "readme": "/package/claude_code/0.2.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/dashboard-session-timeline.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-session-timeline.png",
      "title": "Session Timeline",
      "size": "1024x720",
      "type": "image/png"
    },
    {
      "src": "/img/dashboard-security-overview.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-security-overview.png",
      "title": "Security Overview",
      "size": "1024x995",
      "type": "image/png"
    },
    {
      "src": "/img/dashboard-cost-usage.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-cost-usage.png",
      "title": "Cost & Usage",
      "size": "1024x780",
      "type": "image/png"
    },
    {
      "src": "/img/dashboard-tool-call-analysis.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-tool-call-analysis.png",
      "title": "Tool Call Analysis",
      "size": "1024x1000",
      "type": "image/png"
    },
    {
      "src": "/img/dashboard-mcp-server-access.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-mcp-server-access.png",
      "title": "MCP Server Access",
      "size": "1024x810",
      "type": "image/png"
    },
    {
      "src": "/img/dashboard-permission-decisions.png",
      "path": "/package/claude_code/0.2.0/img/dashboard-permission-decisions.png",
      "title": "Permission Decisions",
      "size": "1024x810",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/claude_code/0.2.0/LICENSE.txt",
    "/package/claude_code/0.2.0/changelog.yml",
    "/package/claude_code/0.2.0/manifest.yml",
    "/package/claude_code/0.2.0/docs/README.md",
    "/package/claude_code/0.2.0/img/claude-logo.svg",
    "/package/claude_code/0.2.0/img/dashboard-cost-usage.png",
    "/package/claude_code/0.2.0/img/dashboard-mcp-server-access.png",
    "/package/claude_code/0.2.0/img/dashboard-permission-decisions.png",
    "/package/claude_code/0.2.0/img/dashboard-security-overview.png",
    "/package/claude_code/0.2.0/img/dashboard-session-timeline.png",
    "/package/claude_code/0.2.0/img/dashboard-tool-call-analysis.png",
    "/package/claude_code/0.2.0/data_stream/events/manifest.yml",
    "/package/claude_code/0.2.0/data_stream/events/sample_event.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-cost-usage.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-mcp-server-access.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-permission-decisions.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-security-overview.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-session-timeline.json",
    "/package/claude_code/0.2.0/kibana/dashboard/claude_code-tool-call-analysis.json",
    "/package/claude_code/0.2.0/data_stream/events/fields/base-fields.yml",
    "/package/claude_code/0.2.0/data_stream/events/fields/ecs.yml",
    "/package/claude_code/0.2.0/data_stream/events/fields/fields.yml",
    "/package/claude_code/0.2.0/data_stream/events/agent/stream/stream.yml.hbs",
    "/package/claude_code/0.2.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "claude_code",
      "title": "Claude Code events",
      "description": "Collect Claude Code agentic telemetry via OpenTelemetry.",
      "inputs": [
        {
          "type": "otelcol",
          "title": "Collect Claude Code events via OpenTelemetry",
          "description": "Receive Claude Code OTLP logs exported by the Claude Code CLI."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "claude_code.events",
      "title": "Claude Code events",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "otelcol",
          "vars": [
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a JSON copy of the raw OTel event in the field event.original. Increases storage but useful for forensic analysis.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Claude Code events",
          "description": "Receive Claude Code OTLP log events.",
          "enabled": true
        }
      ],
      "package": "claude_code",
      "path": "events"
    }
  ]
}