Elastic Security

1. Overview

Elastic Security is a comprehensive security solution that unifies SIEM (Security Information and Event Management), endpoint security, and cloud security to detect, investigate, and respond to threats in real-time. It is built on the Elastic Stack (Elasticsearch, Kibana, Beats, and Logstash), enabling powerful search, analysis, and visualization of security data.

The GoInsight Elastic Security node allows you to automate your security operations and incident response workflows. You can manage the entire lifecycle of security cases directly within your automated processes, including:

• Case Management: Create, retrieve, update, and delete security cases to track incidents.
• Case Enrichment: Add, remove, and retrieve comments and tags to enrich cases with contextual information.
• System Integration: Create connectors to integrate Elastic Security with other third-party systems like Jira, Slack, or ServiceNow.

2. Prerequisites

Before using this node, you must have a valid Elastic Security account with an active deployment. You will also need to generate an API Key with the necessary permissions to manage cases and connectors. You may need administrator-level access to your Elastic deployment to create these credentials.

3. Credentials

For a detailed guide on how to obtain and configure your credentials, please refer to our official documentation: Credentials Configuration Guide.

4. Supported Operations

Summary

This node primarily operates on the following resources: Case, Case Comment, Case Tag, and Connector.

Operation Details

Create a Case

Creates a new case in Elastic Security for tracking security incidents and investigations.

When to use:

• Create a case for a new security incident or alert
• Track investigation progress across your security team
• Link alerts and evidence to a centralized case record

Key points:

• Owner must match your team's Kibana module: securitySolution, observability, or cases
• Severity defaults to low; set high or critical for active threats
• This action does not perform duplicate detection by title, alert, or description
• Use the returned version for subsequent Update a Case calls

[!] Important:

Create is not idempotent. Calling it repeatedly with the same Title and Description may create duplicate cases. Search or list existing cases first when duplicate creation is a concern.

Next:

Use Get a Case to inspect the created case, or Add a Comment to a Case to append investigation notes.

Input Parameters:

• Title: Case title (required). A concise summary of the security incident or investigation. Best practice: include the threat type and affected system (e.g., 'Brute-force attack on prod-web-01', 'Phishing campaign targeting finance team'). Max 256 characters.
• Owner: Case owner (required). Determines which Elastic application manages this case. Choose based on your use case:
• Cases: General case management (non-security issues, IT support tickets)
• Observability: Infrastructure/APM issues (server downtime, performance degradation)
• Security Solution: Security incidents/SIEM (Security Information and Event Management - malware, intrusion detection, threat hunting)

⚠️ Important: Choosing the wrong owner will route the case to the wrong team, potentially delaying incident response. Most security teams should use 'securitySolution'.

• Description: Case description. Provide context about the incident or issue being investigated (required).

Options:

• Severity: Severity level. Determines case priority and SLA (optional, default: 'low').
• Tags: Comma-separated tags for case categorization (optional). Use lowercase, hyphen-separated format (e.g., 'brute-force', 'phishing'). Example: 'malware,endpoint,windows'

Common tag categories:

• Attack types: phishing, malware, ransomware, ddos, brute-force
• Systems: windows, linux, network, endpoint, cloud
• Status: false-positive, confirmed-incident, under-investigation
• Assignees: Comma-separated user UIDs to assign this case (optional). Format: 'u_xxxxx...'. Leave empty to create an unassigned case.

How to get user UIDs:

• Kibana UI: Stack Management > Security > Users > [User Name] > Copy 'User ID'
• API: GET /_security/user (returns all users with UIDs)

Example: 'u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc85HeYRah4_0'

• AdditionalFields: Advanced configuration as JSON object (optional). Use this to integrate with external ticketing systems or configure multi-tenancy.

⚠️ Advanced users only: Most users can leave this empty.

Supported fields:

• ConnectorId: Connector ID from Kibana > Stack Management > Cases > Connectors. Default: 'none'
• ConnectorName: Connector display name. Default: 'none'
• ConnectorType: Connector type (note: values start with a dot per Kibana's internal naming convention). Values: '.none', '.jira', '.servicenow', '.servicenow-sir', '.swimlane', '.resilient'. Default: '.none'
• SpaceId: Kibana space ID for multi-tenancy. Default: 'default'

Example:

{"ConnectorId": "jira-prod-123", "ConnectorName": "Jira Production", "ConnectorType": ".jira", "SpaceId": "security-team"}

Common use cases:

• Sync cases to Jira: Set ConnectorType to '.jira' and provide ConnectorId
• Multi-tenant setup: Set SpaceId to your team's Kibana space

Output:

• CreatedCase (object): The created case object. Key fields:
• id (string): Unique case identifier (UUID format)
• title (string): Case title
• description (string): Case description
• status (string): Case status. Values: 'open', 'in-progress', 'closed'
• severity (string): Severity level. Values: 'critical', 'high', 'medium', 'low'
• owner (string): Case owner (application context)
• created_at (string): Creation timestamp (ISO 8601 format)
• created_by (string): Creator username
• tags (array of strings): Case tags
• assignees (array of strings): Assigned user UIDs (format: 'u_xxxxx...'). Note: Only UIDs are returned, not full user objects. To get user details (username, email), use the Kibana API: GET /_security/user/
• totalAlerts (number): Number of linked alerts
• totalComment (number): Number of comments
• version (string): Version token for optimistic concurrency control
• OriginalStatusCode (number): The original HTTP status code returned by upstream API. 0 = request did not reach upstream (network error or local validation failure).
• StatusCode (number): Operation status code: 200 (success, including API business errors), -1 (local parameter validation error), 500 (network error, may trigger retry). Check OriginalStatusCode and ErrorMessage for details.
• ErrorMessage (string): Error description if the operation fails, empty string on success.

Delete a Case

Permanently deletes one or more cases in Elastic Security.

When to use:

Remove cases that are no longer needed or were created by mistake.

Key points:

• Supports batch deletion with comma-separated CaseIds
• CaseIds are UUID format, get from Get many Cases or Create a Case
• Returns deletedCount, failedCount, and failedItems for tracking

[!] Important:

This is a PERMANENT delete operation and CANNOT be undone. Deleted cases, their comments, alerts, and attachments are permanently removed. Use with extreme caution in production environments.

Input Parameters:

• CaseIds: Comma-separated case IDs to delete. Each ID is a UUID assigned by Elastic Security when a case is created. Supports batch deletion. You can get CaseIds from the Get many Cases action. Example: '550e8400-e29b-41d4-a716-446655440000,660f9511-f3ac-52e5-b827-557766551111'.

Options:

• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation. Most users should use the default value 'default'. Default: 'default'.

Output:

• DeletedCase (object): Business data object containing deletion results. Structure: { deletedCount (number): cases successfully deleted; failedCount (number): cases that failed to delete; failedItems (array): list of { caseId, errorMessage } for each failure }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error). 204 means all cases deleted successfully.
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Get a Case

Retrieves detailed information about a specific case in Elastic Security.

When to use:

• Get full case details before updating or closing
• Check case status, severity, and assigned analysts
• Review case comments and alert counts

Key points:

• CaseId is required, get it from Get Many Cases
• Set IncludeComments to true to retrieve case comments
• Status values: open, in-progress, closed
• Severity values: low, medium, high, critical

[!] Important:

SpaceId defaults to 'default'. Only change if using multi-tenant Kibana Spaces.

Next:

Use 'Update a Case' to modify case details, or 'Add a Comment to a Case' to add comments.

Input Parameters:

• CaseId: The ID of the case to retrieve (required).

How to get Case ID:

• Use Get Many Cases action to find cases by criteria
• Copy from Elastic Security UI: Cases -> Case Details -> URL contains case ID

Example: "8c24f6a0-1a2b-3c4d-5e6f-7890abcdef12"

Options:

• IncludeComments: Whether to include comments in the response (default: false). Set to true when you need to read comment content, get comment IDs for update/delete operations, or review investigation timeline. Note: enabling this increases response size significantly for cases with many comments.
• SpaceId: Kibana space ID (default: 'default').

For most users: Keep the default value "default".

Advanced: If your Elastic instance is configured with multiple Spaces (multi-tenancy), contact your administrator to get the correct Space ID. Space ID can be found in Kibana URL: https://your-kibana.com/s/{space_id}/app/security/cases

Output:

• Case (object): Business data object containing the case details. Structure: API's full response object with all fields (id, title, description, status, severity, owner, tags, assignees, comments, createdAt, createdBy, updatedAt, updatedBy, totalAlerts, totalComments, version, etc.). Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Get Many Cases

Retrieves multiple cases from Elastic Security with pagination, filtering, and sorting.

When to use:

• List security cases with pagination
• Search cases by keyword across title or description
• Filter cases by status, owner, or assignees

Key points:

• Pagination: max 100 per request, use Page and PerPage
• Returns cases with full metadata (id, title, status, severity, assignees, timestamps)
• Filter by status (open, in-progress, closed) or owner type
• Advanced filters (SearchFields, Owner, Assignees) go in AdditionalFilters

Options:

• Page: Page number for pagination. Starts from 1. Use together with PerPage to control pagination. Default: 1.
• PerPage: Number of cases to return per page. Must be between 1 and 100. Use together with Page to paginate through results. Default: 20.
• SortField: Field to sort results by. Supported values:
• 'createdAt': Sort by creation time (default)
• 'updatedAt': Sort by last update time
• 'title': Sort alphabetically by case title
• 'status': Sort by case status
• 'severity': Sort by severity level
• SortOrder: Sort order for results. Supported values:
• 'desc': Newest/highest first (default)
• 'asc': Oldest/lowest first
• Search: Search keyword to filter cases. Searches across case fields specified by AdditionalFilters.SearchFields. Leave empty to retrieve all cases. Example: 'suspicious login'.
• Status: Filter cases by status. Supported values:
• 'open': Cases that are currently being triaged or awaiting action
• 'in-progress': Cases that are actively being investigated
• 'closed': Cases that have been resolved or dismissed

Leave empty to retrieve cases of all statuses.

• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation for organizing dashboards and cases. Most users should use the default value 'default'. If you need to access cases in a different space, contact your Kibana administrator for the correct space ID. Default: 'default'.
• AdditionalFilters: Advanced filtering options (key-value object). For most queries, use the main parameters above.

Supported keys:

• SearchFields (string): Comma-separated fields to search in. Available: title, description, tags, comments. Example: 'title,description'
• Owner (string): Filter by owner type. Values: 'cases' (general), 'observability' (APM/logs/metrics), 'securitySolution' (SIEM/endpoint)
• Assignees (string): Comma-separated assignee user IDs in Elastic format. Example: 'u_abc123,u_def456'

Example: {"SearchFields": "title,description", "Owner": "securitySolution", "Assignees": "u_abc123xyz"}

Output:

• Cases (object): Business data object containing the retrieved cases and pagination metadata. Structure: { cases (array): list of case objects each containing id, title, description, status, severity, owner, tags, assignees, createdAt, updatedAt, totalComment, totalAlerts; page (number): current page number; perPage (number): cases per page; total (number): total matching cases }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Get the Status of a Case

Retrieves the status and key information of a specific case from Elastic Security.

When to use:

• Monitor case progress in automated workflows
• Check case severity before escalation
• Retrieve case details for reporting or dashboards

Key points:

• CaseId is required, get it from Get many Cases or Create a Case
• Returns status, severity, owner, timestamps, and alert/comment counts
• Read-only operation; to update case status, use the Update Case action
• Owner types: cases (general), observability (APM/logs), securitySolution (SIEM)

Input Parameters:

• CaseId: The unique identifier of the case to retrieve status for. You can get this from the Get many Cases or Create a Case action. Format: UUID (e.g., '8c3b8c50-1234-11ec-82a8-0242ac130003').

Options:

• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation for organizing dashboards and cases. Most users should use the default value 'default'. Default: 'default'.

Output:

• CaseStatus (object): Business data object containing the case status and key information. Structure: { caseId (string): unique case identifier; title (string): case title; status (string): case status (open, in-progress, closed); severity (string): severity level (low, medium, high, critical); owner (string): owner application area - cases (general), observability (APM/logs/metrics), securitySolution (SIEM/endpoint); updatedAt (string): last update timestamp in ISO 8601 (e.g., 2024-01-15T10:30:00.000Z); updatedBy (string): username of last updater; totalAlerts (number): number of associated alerts; totalComments (number): number of comments }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Update a Case

Updates an existing case in Elastic Security.

When to use:

• Modify case metadata such as title, status, severity, and tags
• Apply workflow progress updates without recreating the case
• Assign users or set non-default SpaceId via AdditionalFields

Key points:

• Update strategy: Only the fields you provide are changed. Fields you leave empty keep current values (partial update, not full replacement).
• Version is required for optimistic concurrency control
• Status values: open, in-progress, closed
• Severity values: low, medium, high, critical
• AdditionalFields supports Assignees and SpaceId

[!] Important:

Always use the latest Version from "Get a Case" before updating. Stale versions cause conflict errors (OriginalStatusCode=409).

Next:

Use "Get a Case" to confirm updates, or "Add a Comment to a Case" to append investigation notes.

Input Parameters:

• CaseId: The unique identifier of the case to update. You can get this from the Get many Cases or Create a Case action. Format: UUID (e.g., 'a18b38a0-71b0-11ec-9a41-bf3b9c5c8f3a').
• Version: Case version string for optimistic concurrency control. You MUST get the latest version from Get the Status of a Case or Get many Cases before updating. If the version is outdated (another user modified the case), the API returns a 409 conflict error. Format: Base64 encoded (e.g., 'WzEyMzQsIjEiXQ==').

Options:

• Title: New case title. Leave empty to keep the current title unchanged. Optional.
• Description: New case description. Leave empty to keep the current description unchanged. Optional.
• Status: New case status. Leave empty to keep the current status unchanged. Optional.

Supported values:

• open: Case is newly created and awaiting investigation
• in-progress: Investigation is ongoing
• closed: Case is resolved and closed

Example: "in-progress"

• Severity: New severity level. Leave empty to keep the current severity unchanged. Optional.

Supported values:

• critical: Immediate threat requiring urgent response (e.g., active data breach)
• high: Significant security risk requiring prompt attention
• medium: Moderate risk requiring investigation
• low: Minor security concern or informational alert

Example: "high"

• Tags: Comma-separated tags to set on the case. This REPLACES all existing tags (not append). Supports Chinese commas (auto-converted). Leave empty to keep existing tags. Optional.
• AdditionalFields: Advanced optional fields as JSON object. Most users can leave this empty.

Supported fields:

• Assignees: Assignee UIDs. Accepts comma-separated string or string array. Replaces all existing assignees.
• SpaceId: Kibana space ID for multi-tenancy. Default: default.

Example:

{"Assignees": "u_xxx1,u_xxx2", "SpaceId": "default"}

Output:

• Case (object): Business data object containing the updated case details. Returns empty object {} if operation failed (check ErrorMessage for reason).

Core fields:

• id (string): Case unique identifier (UUID)
• title (string): Case title
• description (string): Case description
• status (string): Current status (open/in-progress/closed)
• severity (string): Severity level (low/medium/high/critical)
• tags (array of strings): List of tags
• assignees (array of objects): List of assigned users
  • Each object contains: uid (string)
• version (string): Updated version string (use this for next update)
• updated_at (string): Last update timestamp (ISO 8601)
• updated_by (object): User who performed the update
  • Contains: username (string | null), full_name (string | null), email (string | null)
• created_at (string): Case creation timestamp (ISO 8601)
• created_by (object): User who created the case, same structure as updated_by
• owner (string): Case owner (typically securitySolution)
• totalComment (integer): Total number of comments
• totalAlerts (integer): Total number of linked alerts

Example: {"id": "66b9c2e0-...", "title": "...", "status": "in-progress", "version": "WzE2NzMsMV0=", "assignees": [{"uid": "u_xxx"}], "updated_by": {"username": "admin", "full_name": null, "email": null}}

• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Add a Comment to a Case

Adds a user comment or attaches an alert to an existing Elastic Security case.

When to use:

• Add investigation notes or findings to a security case
• Attach a related alert to an existing case
• Preserve investigation history in the case timeline

Key points:

• Two comment types: 'user' for text comments and 'alert' for alert attachment
• AlertId is required when CommentType is 'alert'; leave AlertId empty for user comments
• This action appends a new comment and does not edit or remove existing comments
• CaseId can be obtained from Get Many Cases or Create a Case

[!] Important:

Adding a user comment is not idempotent. Repeating the same request creates another comment. Confirm the target CaseId and comment text before calling.

Next:

Use Get Many Case Comments to verify the new comment, or Update a Comment from a Case if the comment text needs correction.

Input Parameters:

• CaseId: The unique identifier of the case to add comment to. You can get this from the Get many Cases or Create a Case action. Format: UUID (e.g., 'a18b38a0-71b0-11ec-9a41-bf3b9c5c8f3a').
• Comment: The comment text to add to the case. Supports plain text. Used when CommentType is 'user'.

Options:

• CommentType: The type of comment to add. Supported values:
• 'user': A text comment written by a user (default)
• 'alert': Attach an alert to the case (requires AlertId)
• AlertId: Alert ID to attach to the case. REQUIRED when CommentType is 'alert'. Leave empty for user comments. You can get alert IDs from the Elastic Security alerts page. Example: 'eabbdefc1b2b3c4d5e6f7890'.
• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation for organizing dashboards and cases. Most users should use the default value 'default'. Default: 'default'.

Output:

• CaseComment (object): Business data object containing the created comment details. Structure: { commentId (string): unique comment identifier; caseId (string): associated case ID; comment (string): comment content; type (string): comment type (user/alert); createdAt (string): creation timestamp in ISO 8601; createdBy (string): creator username; updatedAt (string): last update timestamp; updatedBy (string): updater username; version (string): comment version for concurrency control }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Get a Case Comment

Retrieves detailed information for a specific case comment in Elastic Security.

When to use:

• Get the full comment object before update or deletion actions
• Verify who created or updated a comment and when it changed
• Inspect alert-linked comment payload returned by Elastic Security

Key points:

• Requires both CaseId and CommentId to locate the exact comment
• Returns the complete API response object without field filtering
• StatusCode is unified: -1 (validation), 200 (request completed), 500 (network/system)
• Use OriginalStatusCode to see the real upstream HTTP status

[!] Important:

Business/API errors still return StatusCode=200. Always check ErrorMessage and OriginalStatusCode together.

Next:

Use "Update a Comment from a Case" to edit the comment, or "Remove a Comment from a Case" to delete it.

Input Parameters:

• CaseId: The ID of the case containing the comment to retrieve (required).

How to get Case ID:

• Use Get Many Cases action to find cases by criteria
• Copy from Elastic Security UI: Cases -> Case Details -> URL contains case ID

Example: "8c24f6a0-1a2b-3c4d-5e6f-7890abcdef12"

• CommentId: The ID of the case comment to retrieve (required).

How to get Comment ID:

• Use Get Many Case Comments action with the same CaseId
• Copy from Elastic Security UI by opening the comment details

Example: "8af6ac20-74f6-11ea-b83a-553aecdb28b6"

Options:

• SpaceId: Kibana space ID (default: 'default').

For most users: Keep the default value "default".

Advanced: If your Elastic instance is configured with multiple Spaces (multi-tenancy), contact your administrator to get the correct Space ID.

Output:

• CaseComment (object): Business data object containing the case comment details. Structure: API's full response object with all fields (id, caseId, type, comment, owner, actions, created_at, created_by, updated_at, updated_by, pushed_at, pushed_by, version, alertId, index, rule, etc.). Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Get Many Case Comments

Retrieves multiple comments from a case in Elastic Security with pagination.

When to use:

• List all comments on a security case
• Paginate through case discussion history

Key points:

• CaseId is required, get it from Get many Cases or Create a Case
• Returns comments with metadata (id, type, content, timestamps, author)
• Supports pagination with Page and PerPage
• Comment types: user (text) and alert (attached alert)

Input Parameters:

• CaseId: The unique identifier of the case to retrieve comments from. You can get this from the Get many Cases or Create a Case action. Format: UUID (e.g., 'a18b38a0-71b0-11ec-9a41-bf3b9c5c8f3a').

Options:

• Page: Page number for pagination. Starts from 1. Use together with PerPage to control pagination. Default: 1.
• PerPage: Number of comments to return per page. Must be a positive integer. Use together with Page to paginate through results. Default: 20.
• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation for organizing dashboards and cases. Most users should use the default value 'default'. Default: 'default'.

Output:

• CaseComments (object): Business data object containing the retrieved comments and pagination metadata. Structure: { comments (array): list of comment objects each containing commentId, caseId, type (user/alert), comment, createdAt (ISO 8601), createdBy, updatedAt, updatedBy, version; page (number): current page number; perPage (number): comments per page; total (number): total matching comments }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Remove a Comment from a Case

Removes a specific comment from an existing case in Elastic Security.

When to use:

• Delete incorrect, duplicate, or obsolete comments from a case
• Remove sensitive text that was posted by mistake
• Keep case timelines clean before handover or closure

Key points:

• This operation targets exactly one comment by CaseId + CommentId
• Successful delete usually returns 204 from upstream API
• StatusCode remains 200 for all completed API responses; check ErrorMessage and OriginalStatusCode
• Returns removal result in RemovedComment object

[!] Important:

Comment deletion is permanent and cannot be undone.

Next:

Use "Get Many Case Comments" to confirm the comment is removed, or "Add a Comment to a Case" to post a corrected note.

Input Parameters:

• CaseId: The ID of the case containing the comment to remove (required).

How to get Case ID:

• Use Get Many Cases action to find cases by criteria
• Copy from Elastic Security UI: Cases -> Case Details -> URL contains case ID

Example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"

• CommentId: The ID of the comment to remove (required).

How to get Comment ID:

• Use Get Many Case Comments action with the same CaseId
• Copy from Elastic Security UI by opening the comment details

Example: "c9d8e7f6-a5b4-3210-9876-543210fedcba"

Options:

• SpaceId: Kibana space ID (default: 'default').

For most users: Keep the default value "default".

Advanced: If your Elastic instance is configured with multiple Spaces (multi-tenancy), use the corresponding Space ID.

Output:

• RemovedComment (object): Business data object containing the comment removal result. Structure: API's full response object for delete operation. For 204 no-content responses, returns an object with deletion metadata (deleted, caseId, commentId, statusCode). Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Update a Comment from a Case

Updates an existing comment in a case in Elastic Security.

When to use:

• Correct or revise a previously submitted case comment
• Update investigation notes as new information becomes available
• Edit comment content without changing other case fields

Key points:

• Requires the current comment version from Get Many Case Comments to prevent concurrent edit conflicts
• Only the comment text is updated; metadata such as created_at and created_by remains unchanged
• Use the new version from the response for any subsequent update calls

[!] Important:

This is a PATCH-style text update protected by optimistic concurrency. If the version is stale, the API returns a 409 conflict. Always fetch the latest version before updating.

Next:

Use Get Many Case Comments to confirm the updated text and capture the new version for later edits.

Input Parameters:

• CaseId: Case ID (required). The unique identifier of the case containing the comment. Can be obtained from 'Get Many Cases' action. Format: UUID (e.g., a18b38a0-71b0-11e9-a555-232267a0b87a).
• CommentId: Comment ID to update (required). The unique identifier of the comment to update. Can be obtained from 'Get Many Case Comments' action. Format: UUID (e.g., 8af6ac20-74f6-11ea-b83a-553aecdb28b6).
• Comment: New comment content (required). The updated text content for the comment.
• Version: Comment version for concurrency control (required). This version string is returned by 'Get Many Case Comments' action and must be provided to prevent conflicts when multiple users edit the same comment. Format: Base64-encoded string (e.g., WzU3LDFd).

Options:

• SpaceId: Kibana space ID (default: 'default'). Spaces are used for multi-tenancy isolation in Kibana. Most users should use the default value 'default'. Only change this if you are working in a specific Kibana space.

Output:

• Comment (object): The updated comment object. Key fields:
• id (string): Unique comment identifier (UUID format)
• comment (string): The updated comment text content
• type (string): Comment type. Values: 'user' (regular comment), 'alert' (system alert comment)
• owner (string): The application that owns this comment
• created_at (string): Creation timestamp (ISO 8601 format)
• created_by (object): Creator info with username and profile_uid fields
• updated_at (string): Last update timestamp (ISO 8601 format)
• updated_by (object): Last updater info with username and profile_uid fields
• version (string): New version token for subsequent update calls (optimistic concurrency control)
• case_id (string): The case ID this comment belongs to

Returns empty object {} if operation failed (check ErrorMessage for reason).

• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Add a Tag to a Case

Adds one or more tags to an existing case in Elastic Security.

When to use:

• Add workflow labels such as urgent, reviewed, or escalated
• Classify incidents by type, team, or compliance requirement
• Enrich case metadata without replacing existing tags

Key points:

• Existing tags are preserved and merged with new tags
• Duplicate tags are removed automatically
• Use English comma separators in automation inputs
• Returns complete upstream update response in CaseTag object

[!] Important:

This action appends/merges tags only. To replace all tags, use "Update a Case".

Next:

Use "Get a Case" to verify tag changes, or "Remove a Tag from a Case" to clean up labels.

Input Parameters:

• CaseId: The ID of the case to update tags for (required).

How to get Case ID:

• Use Get Many Cases action to find cases by criteria
• Copy from Elastic Security UI: Cases -> Case Details -> URL contains case ID

Example: "8c8b9f50-7f5e-11ef-9b5a-c9b7e1a9d8c3"

• Tags: Comma-separated tags to add to the case (required).

Format rules:

• Separate multiple tags with an English comma (,)
• Alternate comma characters are accepted and auto-converted
• Existing tags are preserved and duplicates are removed automatically

Examples:

• Single tag: "urgent"
• Multiple tags: "urgent, reviewed, escalated"
• Prefer English comma separators in automation inputs.

Options:

• SpaceId: Kibana space ID (default: 'default').

For most users: Keep the default value "default".

Advanced: If your Elastic instance is configured with multiple Spaces (multi-tenancy), use the corresponding Space ID.

Output:

• CaseTag (object): Business data object containing the tag update details. Structure: API's full response object after tag update. If upstream returns a list, it is wrapped as {"cases": [...]} to keep object type. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Remove a Tag from a Case

Removes one or more tags from a case in Elastic Security.

When to use:

• Remove outdated or incorrect tags from a security case
• Clean up case labels after investigation status changes
• Undo a previous Add a Tag to a Case call

Key points:

• Tags are comma-separated; an alternate comma character is auto-converted
• Tag names are case-sensitive
• Tags not found on the case are silently ignored and do not cause an error
• Returns both removedTags and remainingTags in the result

[!] Important:

This action updates case labels but does not delete the case. Confirm the target CaseId and tag names before calling. Removing a missing tag is effectively idempotent.

Next:

Use Get a Case to verify remaining tags, or Add a Tag to a Case to restore a removed label.

Input Parameters:

• CaseId: The unique identifier of the case to remove tags from. You can get this from the Get many Cases or Create a Case action. Format: UUID (e.g., '8c24f6e0-1234-11ef-9876-abcdef123456').
• Tags: Tags to remove from the case, comma-separated. Supports Chinese commas (auto-converted). Tag names are case-sensitive. Tags that do not exist on the case will be silently ignored (no error). Example: 'malware,phishing,high-priority'.

Options:

• SpaceId: Kibana space ID. Kibana Spaces provide multi-tenancy isolation for organizing dashboards and cases. Most users should use the default value 'default'. Default: 'default'.

Output:

• RemovedCaseTag (object): Business data object containing the tag removal result. Structure: { removedTags (array): list of tags that were actually removed; remainingTags (array): list of tags still on the case after removal; caseId (string): the case ID that was modified }. Returns empty object {} if operation failed (check ErrorMessage for reason).
• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

Create a Connector

Creates a new connector in Elastic Security for integrating with external systems.

When to use:

• Register a new external integration for alerts or case workflows
• Set up connectors for Jira, ServiceNow, Slack, webhook, or AI services
• Prepare downstream actions that require a connector ID

Key points:

• Returns the complete connector object from Elastic API without field filtering
• Config and Secrets requirements depend on ConnectorTypeId
• This action does not prevent duplicate connector names
• Connector secrets may grant access to external systems

[!] Important:

Create is not idempotent. If a connector with the same name already exists, this action may still create another one. Check existing connectors before creating.

Next:

Use the returned connector ID in Create a Case connector fields, or inspect connectors in Elastic before creating another connector.

Input Parameters:

• Name: Connector name (required). Use a clear, unique name to avoid creating duplicate connectors by mistake.

Example: "My Jira Connector"

• ConnectorTypeId: Connector type ID - select from available options (required).

Common types:

• Case management: .jira, .servicenow, .resilient, .swimlane
• Communication: .slack, .slack_api, .teams, .email
• Incident response: .pagerduty, .opsgenie, .xmatters
• SOAR/automation: .torq, .tines, .xsoar
• AI/ML: .gen-ai, .bedrock, .gemini
• Other: .webhook, .server-log, .index

Tip: Refer to Elastic Security documentation for available connector types in your environment.

Options:

• Config: Connector configuration object (non-sensitive settings). Config vs Secrets: Config holds non-sensitive settings (URLs, project keys), Secrets holds sensitive credentials (passwords, tokens).

Required fields vary by connector type.

Jira (.jira):

• apiUrl (string): Jira instance URL
• projectKey (string): Jira project key

ServiceNow (.servicenow):

• apiUrl (string): ServiceNow instance URL
• usesTableApi (boolean): Whether to use Table API

Slack (.slack):

• No config fields required

Webhook (.webhook):

• url (string): Webhook endpoint URL
• method (string): HTTP method (POST/PUT)
• headers (object): Custom headers

For other connector types, refer to Elastic Security documentation.

Example: {"apiUrl": "https://your-domain.atlassian.net", "projectKey": "PROJ"}

• Secrets: Connector authentication secrets (sensitive credentials). Config vs Secrets: Config holds non-sensitive settings (URLs, project keys), Secrets holds sensitive credentials (passwords, tokens).

Required fields vary by connector type.

Jira (.jira):

• email (string): Jira user email
• apiToken (string): Jira API token

ServiceNow (.servicenow):

• username (string): ServiceNow username
• password (string): ServiceNow password

Slack API (.slack_api):

• token (string): Slack bot token

Webhook (.webhook):

• user (string): Basic auth username (optional)
• password (string): Basic auth password (optional)

For other connector types, refer to Elastic Security docs.

Example: {"email": "user@example.com", "apiToken": "your_api_token_here"}

• Description: Connector description (optional). This field may not be stored for all connector types depending on Elastic API behavior.

Output:

• Connector (object): Business data object containing the connector details. Returns empty object {} if operation failed (check ErrorMessage for reason).

Core fields:

• id (string): Unique connector identifier (UUID)
• name (string): Connector display name
• connector_type_id (string): Connector type (e.g., .jira, .slack)
• config (object): Non-sensitive configuration (structure varies by type)
• is_preconfigured (boolean): Whether connector is pre-configured by admin
• is_deprecated (boolean): Whether connector type is deprecated
• is_system_action (boolean): Whether this is a system-level action
• referenced_by_count (number): Number of rules/cases using this connector
• created_at (string): Creation timestamp (ISO 8601)
• created_by (object): Creator info with username field
• updated_at (string): Last update timestamp (ISO 8601)
• updated_by (object): Last updater info with username field

Note: secrets field is never returned by API for security reasons.

• OriginalStatusCode (number): The original HTTP status code returned by Elastic Security API. 0 if request did not reach the API (local validation error or network error).
• StatusCode (number): Operation status code. -1 for parameter validation error, 200 for request completed (check ErrorMessage for business errors), 500 for network/system errors (Agent may retry).
• ErrorMessage (string): Error details if any, empty string otherwise.

5. Example Usage

This section will guide you through creating a simple workflow to automatically open a new security case in Elastic Security whenever a specific trigger occurs.

The workflow will consist of a Start node, an Elastic Security tool node, and an Answer node.

Step 1: Add the Tool Node

1. In the workflow canvas, click the + button to add a new node.
2. Select the "Tool" tab in the pop-up panel.
3. Find and select Elastic Security from the list of tools.
4. From the list of supported operations for Elastic Security, click on Create a Case. This will add the node to your canvas.

Step 2: Configure the Node

1. Click on the newly added Create a Case node to open its configuration panel on the right.
2. Credentials Configuration: Find the credentials field at the top of the panel. Click the dropdown menu and select the Elastic Security credential you have already configured.
3. Parameter Configuration: Fill in the required input parameters for the operation.
   • Title: Enter a descriptive title for the case. You can use variables from previous nodes. For example: Suspicious Login from {{ $start.body.ip_address }}.
   • Owner: Select the appropriate owner from the dropdown list, such as securitySolution.
   • Description: Provide a detailed description of the incident. This can also include variables for dynamic content. For example: A high-risk login attempt was detected from IP address {{ $start.body.ip_address }} at {{ $start.body.timestamp }}. Please investigate.
   • Severity: (Optional) Set a severity level like high to prioritize the case.

Step 3: Run and Validate

1. Once all required parameters are correctly filled, any error indicators on the node will disappear.
2. Click the "Run" button in the top-right corner of the canvas to execute the workflow.
3. After a successful run, you can click the log icon in the top-right corner to view the detailed inputs and outputs of the node, confirming that the case was created and retrieving its CaseId.

After completing these steps, your workflow is fully configured. When triggered, it will automatically create a new, detailed case in your Elastic Security instance, ready for investigation by your security team.

6. FAQs

Q: What should I do if I receive a 401 Unauthorized or 403 Forbidden error?

A: These errors typically indicate a problem with your API credentials. Please check the following:

• Ensure your API Key is correct and has not expired.
• Verify that the API Key has the necessary permissions (privileges) in Elastic Security to perform the requested action (e.g., create/read/update cases).

Q: Why did my 'Update a Case' operation fail with a 409 Conflict error?

A: A 409 Conflict error occurs when the Version number you provided in the request does not match the current version of the case on the server. This is a concurrency control mechanism to prevent overwriting simultaneous updates. To resolve this, you should first use the Get a Case operation to fetch the latest case details, including the current Version, and then use that Version number in your update request.

Q: How do I format the Config and Secrets parameters for the 'Create a Connector' operation?

A: The Config and Secrets parameters expect a JSON object. You can either pass a valid JSON object directly from a previous node or provide a string that represents a valid JSON. For example, for a simple webhook connector, the Config might be a JSON string like {"url": "https://my.webhook.url/endpoint", "method": "post"}.

7. Official Documentation

For more in-depth information about the Elastic Security API, please refer to the official documentation:

Elastic Security Cases API Documentation