Connectors in Elastic Agent Builder

The Elastic Agent Builder connectors library lets you configure action-based connectors that give agents access to external systems, such as messaging services, cloud functions, and third-party APIs.

You manage connectors per Kibana space from Manage components → Connectors. Individual connector types in the catalog can be marked Technical preview.

An agent can only run the connectors assigned to it. Agents look up connectors and load their sub-actions and parameter schemas at run time through the built-in connector-discovery skill, which Enable Elastic capabilities includes. To assign connectors, refer to Assign connectors to an agent.

Within those connectors, an agent sees only the actions that the connector allows and that aren't marked Workflow only. Refer to Limit a connector's actions.

Unlike standalone tools, connectors don't need to be assigned to agents: any agent can use any connector in the space.

When an agent needs to interact with an external system, it automatically reads the schemas of the connectors available to it. It then uses a built-in system tool (platform.core.execute_connector_sub_action) to independently format API payloads and run specific sub-actions (for example, looking up a Slack channel ID or searching AlienVault OTX for threat intelligence) without any manual tool mapping.

To register a new connector:

1. In the sidebar, select Manage components → Connectors to open the Connectors library.
2. Click Create connector.
3. Select a connector type from the catalog.
4. Provide the required configuration.
5. (Optional) If the form includes Actions, select Custom to limit which actions the connector can run. Refer to Limit a connector's actions.
6. Click Save.

The configured connector appears in the library.

To let an agent use the connector, assign it to the agent.

Any agent can use the connector immediately.

Newer connector types, such as Gmail, Jira Cloud, and GitHub, include an Actions setting on the create and edit form when they define more than one action. Older connector types, such as Email, Jira, and ServiceNow ITSM, don't show it, even when they have several actions.

The setting applies everywhere the connector runs: in agents, workflows, and the Run a connector API. Kibana rejects calls to actions that the setting doesn't allow.

The Actions setting has two options:

All

The default. Allows every action, including actions added to the connector type in later versions.

Custom

Allows only the actions you select. You must select at least one action.

When you first switch to Custom, the read actions are selected by default. You can change the selection.

Actions added to the connector type later stay unselected until you edit the connector and select them.

Each action has a scope badge: read, write, or destroy. Some actions also have a Workflow only badge. Agents can't run these actions, even when the connector allows them. The Run a connector API can run them, and so can workflows, for connector types available in workflows.

The following screenshot shows a GraphQL connector in Custom mode, with its read actions selected and a Workflow only action left unselected:

×

To change which actions an existing connector allows:

1. In the sidebar, select Manage components → Connectors.
2. In the Connectors library, click the connector name to open its edit form.
3. Under Actions, select Custom.
4. Select the actions to allow.
5. Click Save.

The allowed actions are the same for every caller of the connector. To make an action with the write or destroy badge available to workflows but not to agents:

• Use a separate connector for workflows, and don't assign it to the agent.
• Don't give the agent a workflow tool that runs that workflow.

This works only for connector types available in workflows.

An agent can only use the connectors you assign to it, and new agents start with none. You assign connectors from the agent after you save it.

To assign connectors in Kibana, you need permission to edit the agent and the Actions and Connectors: All Kibana privilege. If Enable Elastic capabilities is off for the agent, also assign the built-in connector-discovery skill. Without it, the agent can't find its connectors.

To assign a connector to an agent:

1. Select the agent. Then, in the sidebar under Customize, select Connectors.
2. Select Add connector.
3. Select one of the following:
   • From library: Assign connectors that already exist in the connectors library.
   • Create new connector: Configure a new connector. It's added to the library and assigned to the agent.

To unassign a connector, remove it from the agent's Connectors page. The connector stays in the library, and other agents it's assigned to can still use it.

When an agent needs access to an OAuth connector, the chat pauses and displays an authorization prompt. Select Authorize to open the provider's sign-in flow in a new browser tab. After authorization succeeds, return to the chat, where the agent retries the connector call and continues. Select Deny to cancel the call.

If authorization fails or the provider does not return you to Kibana, close the provider tab and select Deny in the chat. Correct the connector or OAuth configuration, then retry your request. To learn more about this prompt, refer to Authorize a connector.

• Tools in Elastic Agent Builder
• Skills in Elastic Agent Builder
• Plugins in Elastic Agent Builder
• Custom agents