CONNECT APP
Build with Elastic Security
Detect, investigate, and respond to threats with an all-in-one solution that unifies SIEM, XDR, and cloud security, all powered by AI.
Security
- API key
MCP
Give your agent Elastic Security tools
Every Elastic Security action is exposed as an MCP tool on Pipedream's remote server. Point a client at it with your end user's ID and Connect resolves that user's Elastic Security account for each tool call — you store no tokens.
// accessToken: mint a short-lived token with the Connect SDK — see the MCP guide
const transport = new StreamableHTTPClientTransport(
new URL("https://remote.mcp.pipedream.net/v3"),
{
requestInit: {
headers: {
Authorization: `Bearer ${accessToken}`,
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
"x-pd-app-slug": "elastic_security",
},
},
},
)
const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)
const { tools } = await mcp.listTools()
// e.g. run Add Case Comment:
const result = await mcp.callTool({
name: "elastic_security-add-case-comment",
arguments: {
caseId: "Case ID",
comment: "Comment",
},
})# access_token: mint a short-lived token with the Connect SDK — see the MCP guide
headers = {
"Authorization": f"Bearer {access_token}",
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", # any stable ID for this user in your system
"x-pd-app-slug": "elastic_security",
}
async with streamablehttp_client("https://remote.mcp.pipedream.net/v3", headers=headers) as (read, write, _):
async with ClientSession(read, write) as session:
await session.initialize()
tools = await session.list_tools()
# e.g. run Add Case Comment:
result = await session.call_tool("elastic_security-add-case-comment", {
"caseId": "Case ID",
"comment": "Comment",
})API PROXY
Call the Elastic Security API directly
For an endpoint with no pre-built tool, the Connect proxy forwards your request to the Elastic Security API with the connected user's credentials attached. You store no tokens and write no refresh logic.
const resp = await pd.proxy.get({
externalUserId: "{external_user_id}", // any stable ID for this user in your system
accountId: "apn_xxxxxxx",
url: "https://api.example.com/v1/me",
})
// Any allowed Elastic Security endpoint works here. Pipedream attaches the
// connected account's credentials to the outgoing request.# The path segment is the target URL, URL-safe base64 encoded:
# https://api.example.com/v1/me
curl "https://api.pipedream.com/v1/connect/{project_id}/proxy/aHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20vdjEvbWU?external_user_id={external_user_id}&account_id=apn_xxxxxxx" \
-H "Authorization: Bearer {access_token}" \
-H "x-pd-environment: production"SDK
Run Elastic Security actions from your backend
Connect a user's Elastic Security account once, then run Add Case Comment on their behalf from your own code — TypeScript, Python, or plain HTTP.
import { PipedreamClient } from "@pipedream/sdk"
const pd = new PipedreamClient({
projectId: process.env.PIPEDREAM_PROJECT_ID!,
clientId: process.env.PIPEDREAM_CLIENT_ID!,
clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
projectEnvironment: "production",
})
const result = await pd.actions.run({
id: "elastic_security-add-case-comment",
externalUserId: "{external_user_id}", // any stable ID for this user in your system
configuredProps: {
elastic_security: { authProvisionId: "apn_xxxxxxx" },
caseId: "Case ID",
comment: "Comment",
},
})from pipedream import Pipedream
pd = Pipedream(
client_id="{oauth_client_id}",
client_secret="{oauth_client_secret}",
project_id="{project_id}",
project_environment="production",
)
result = pd.actions.run(
id="elastic_security-add-case-comment",
external_user_id="{external_user_id}", # any stable ID for this user in your system
configured_props={
"elastic_security": {"authProvisionId": "apn_xxxxxxx"},
"caseId": "Case ID",
"comment": "Comment",
},
)curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
-H "Content-Type: application/json" \
-H "X-PD-Environment: production" \
-H "Authorization: Bearer {access_token}" \
-d '{
"external_user_id": "{external_user_id}",
"id": "elastic_security-add-case-comment",
"configured_props": {
"elastic_security": { "authProvisionId": "apn_xxxxxxx" },
"caseId": "Case ID",
"comment": "Comment"
}
}'TOOLS
Elastic Security actions
On-demand operations your product or agent can configure and run on behalf of a connected user.
-
Add Case Comment
actionAdd a user comment to an Elastic Security case via POST /api/cases/{caseId}/comments. Use this to log investigation notes or updates on a case without changing its status or fields — use Create or Update Case for that. Run Find Cases first to obtain a valid case ID. Example: calling withcaseId: "a1c1..."andcomment: "Confirmed unauthorized access via badge logs."returns the updated case object withtotalCommentincremented and the new comment incomments. See the documentationWritev0.0.1 -
Create or Update Case
actionCreate a new Elastic Security case, or update an existing one whencaseIdis provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or status. WhencaseIdis provided, the tool fetches the case's currentversioninternally before updating — never guess or supply a version yourself. Run Find Cases first to obtain acaseIdfor updates. Use Add Case Comment to attach comments instead of this tool.titleanddescriptionare required when creating (nocaseId). Example: calling withtitle: "Perimeter Breach",description: "...",severity: "high"returns{ id: "a1c1...", title: "Perimeter Breach", status: "open", version: "Wzc1LDFd", ... }; calling again with thatcaseIdandstatus: "closed"returns the same case updated. See the create documentation and the update documentationWritev0.0.1 -
Create or Update Detection Rule
actionCreate a new Elastic Security detection rule via POST /api/detection_engine/rules, or full-replace update an existing one whenidis provided, via PUT /api/detection_engine/rules. On update, the tool first fetches the rule's current definition and merges your supplied fields into it, so you only need to pass the fields you want to change — Kibana's underlying PUT still requires the full definition, but this tool handles that for you. Run Find Detection Rules first to obtain theidfor updates (it also acceptsruleIdif that's all you have).name,description,riskScore,severity, andtypeare required when creating (noid); optionally setruleIdon create to assign a customrule_idinstead of letting Kibana generate one. Fortype: thresholdrules, setthreshold. Fortype: threat_matchrules, setthreatIndexandthreatMapping. UseadditionalFieldsas an escape hatch for any other type-specific fields (e.g.anomaly_thresholdformachine_learningrules). Example: calling withname: "Suspicious PowerShell",description: "...",riskScore: 60,severity: "high",type: "query",query: "process.name: powershell.exe"returns{ id: "7ac3...", rule_id: "f3bb...", name: "Suspicious PowerShell", enabled: true, ... }; calling again with thatidandriskScore: 80returns the same rule with only the risk score changed. See the create documentation and the update documentationWritev0.0.1 -
Delete Record
actionPermanently delete an Elastic Security case or detection rule by ID. Cases are deleted via DELETE /api/cases; detection rules via DELETE /api/detection_engine/rules. Run Find Cases or Find Detection Rules first to obtain a valid ID for the object you want to delete. Example: calling withobjectType: "case"andrecordId: "a1c1..."returns{ success: true, objectType: "case", recordId: "a1c1..." }. This is destructive and cannot be undone. See the delete case documentation and the delete rule documentationWritev0.0.1 -
Find Assignable Users
actionList users who have created or reported Elastic Security cases, via GET /api/cases/reporters, to discover validprofile_uidvalues for theassigneesparameter on Create or Update Case. Kibana has no public endpoint for listing every org user or for listing who is eligible for assignment — this endpoint only covers people who have reported at least one case, which is a subset of valid assignees, not the full set. If the person you need doesn't appear here (e.g. they've never reported a case), ask the user for theirprofile_uiddirectly instead of guessing. Example: calling with no parameters returns[{ username: "jsmith", full_name: "Jane Smith", email: "jane@example.com", profile_uid: "u_abc123_cloud" }]; pass thatprofile_uidas an entry in Create or Update Case'sassigneesarray. See the documentationRead-onlyv0.0.1 -
Find Cases
actionFind and list Elastic Security cases via GET /api/cases/_find, or fetch a single case directly via GET /api/cases/{caseId} whencaseIdis provided. Use this to search/browse cases, or to look up one case's full details (including itsversiontoken) once you have an ID. Run this first to obtain acaseIdbefore using Create or Update Case, Add Case Comment, or Delete Record. Example: calling withsearch: "perimeter breach"andstatus: "open"returns{ total: 1, cases: [{ id: "a1c1...", title: "Isla Nublar Perimeter Breach", severity: "high", status: "open", ... }] }; usefieldsto shrink each case down to just the fields you need. See the documentationRead-onlyv0.0.1 -
Find Detection Rules
actionFind and list Elastic Security detection rules via GET /api/detection_engine/rules/_find, or fetch a single rule directly via GET /api/detection_engine/rules whenidorruleIdis provided. Use this to search/browse rules, or to look up one rule's full definition once you have an ID. Run this first to obtain anid/ruleIdbefore using Create or Update Detection Rule, Run Detection Rule, or Delete Record. Example: calling withfilter: 'alert.attributes.enabled: true'returns{ total: 3, data: [{ id: "7ac3...", name: "InGen Perimeter Query Rule", type: "query", enabled: true, ... }] }; usefieldsto shrink each rule down to just the fields you need — rule objects carry many advanced fields (exceptions_list,related_integrations,threat, etc.) that are rarely relevant. See the documentationRead-onlyv0.0.1 -
List Tags
actionList all unique tags currently in use across Elastic Security cases via GET /api/cases/tags, or detection rules via GET /api/detection_engine/tags. Use this before tagging a case or rule so you reuse an existing tag instead of creating a near-duplicate (e.g.incident-responsevs.incident_response). Cross-referenced by thetagsparameter on Create or Update Case, Create or Update Detection Rule, and Find Cases. Example: calling withobjectType: "case"returns["council-jurassic-eval", "ransomware", "insider-threat"]. See the case tags documentation and the rule tags documentationRead-onlyv0.0.1 -
Run Detection Rule
actionManually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk actionrun). Use this to test a rule immediately instead of waiting for its next scheduled interval, or to backfill detections over a past window. Provide the rule ids to execute. Run Find Detection Rules first to obtain valid ids. Defaults to roughly the last hour if not specified:endDatedefaults to one minute ago (a small buffer so clock skew/latency can't push it into the future, which Kibana rejects), andstartDatedefaults to one hour before that. Note: Kibana rejects manual runs against disabled rules — the rule must haveenabled: true(see Create or Update Detection Rule). Example: calling withids: ["7ac3..."]and no dates returns{ attributes: { results: { created: [{ id: "7ac3...", name: "..." }] }, summary: { succeeded: 1, failed: 0 } } }. See the documentationWritev0.0.1 -
Search Alerts
actionSearch Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status, or to investigate alert volume/details for a case. Returns the raw Elasticsearch search response with ahits.hitsarray; each hit's_idis the signal ID and_sourceholds the alert's full ECS document. Example: calling withquery: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}}andsize: 5returns{ hits: { total: { value: 12 }, hits: [{ _id: "abc123", _source: { "@timestamp": "...", "kibana.alert.workflow_status": "open", "host.name": "..." } }, ...] } }. Omitqueryto match all alerts._sourcealways holds the full ECS document; usefieldsto additionally get a compact, array-valued view of just the fields you need (under each hit'sfieldskey) without parsing the full document yourself. See the documentationRead-onlyv0.0.1 -
Update Alert Status
actionSet the workflow status of one or more Elastic Security alerts (signals) by ID via POST /api/detection_engine/signals/status. Run Search Alerts first to obtain signal IDs. Example: calling withalertStatus: "closed",signalIds: ["abc123"],reason: "false_positive"returns{ updated: 1, version_conflicts: 0 }. See the documentationWritev0.0.1
EVENTS
Elastic Security triggers
Event sources your backend can deploy for users and receive through a webhook.
No Elastic Security triggers are available yet.
REFERENCE
App details
Reference metadata for the Elastic Security connector in the Pipedream registry.
- App slug
- elastic_security
- Authentication
- API key
- Categories
- Security
- Actions
- 11
- Triggers
- 0
- API proxy
- Available