Monitoring Claude Code/Cowork at scale with OTel in Elastic
ID: fff3e252-83cf-54cc-80e7-82bfabf43c2d
STIX ID: report--fff3e252-83cf-54cc-80e7-82bfabf43c2d
Feed Name: Elastic Security Labs
Elastic's InfoSec team details how to monitor AI coding assistants (Claude Code and Cowork) by exporting OpenTelemetry (OTel) telemetry into Elasticsearch, describing two ingestion architectures (self-managed EDOT gateway or Elastic Cloud Managed OTLP), custom index/mapping and ingest-pipeline configurations to parse tool parameters and numeric fields, deployment/configuration options, and security use cases such as tool invocation auditing, session reconstruction, permission decision analysis, cost anomaly detection, EDR correlation, and MCP server access monitoring.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.