# Elastic Security — Pipedream Connect

> Detect, investigate, and respond to threats with an all-in-one solution that unifies SIEM, XDR, and cloud security, all powered by AI.

- API slug: `elastic_security` (use in MCP headers and tool keys)
- Auth: API key (Pipedream-managed)
- Categories: Security
- Website: https://www.elastic.co/security
- This page (HTML): https://pipedream.com/apps/elastic-security
- Tools: 11 actions · 0 triggers

## Connect via MCP (recommended)

- Endpoint: `https://remote.mcp.pipedream.net/v3`
- Headers: `Authorization: Bearer <token>` · `x-pd-project-id` · `x-pd-environment` · `x-pd-external-user-id` · `x-pd-app-slug: elastic_security`

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// e.g. run Add Case Comment:
const result = await mcp.callTool({
  name: "elastic_security-add-case-comment",
  arguments: {
    caseId: "Case ID",
    comment: "Comment",
  },
})
```

Docs: [MCP guide](https://pipedream.com/docs/connect/mcp/developers.md)

## API proxy

For a Elastic Security endpoint with no pre-built tool, the proxy forwards your request with the connected user's credentials attached.

```bash
# The path segment is the target URL, URL-safe base64 encoded:
# https://api.example.com/v1/me

curl "https://api.pipedream.com/v1/connect/{project_id}/proxy/aHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20vdjEvbWU?external_user_id={external_user_id}&account_id=apn_xxxxxxx" \
  -H "Authorization: Bearer {access_token}" \
  -H "x-pd-environment: production"
```

Docs: [API proxy guide](https://pipedream.com/docs/connect/api-proxy.md)

## SDK

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-add-case-comment",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    caseId: "Case ID",
    comment: "Comment",
  },
})
```

Docs: [Managed auth guide](https://pipedream.com/docs/connect/managed-auth/quickstart.md) · [Tools guide](https://pipedream.com/docs/connect/components.md)

## Actions (11)

### `elastic_security-add-case-comment` — Add Case Comment (Write)

Add a user comment to an Elastic Security case via POST /api/cases/{caseId}/comments. Use this to log investigation notes or updates on a case without changing its status or fields — use Create or Update Case for that. Run Find Cases first to obtain a valid case ID. Example: calling with caseId…

Full schema: https://pipedream.com/apps/elastic-security/actions/add-case-comment.md

### `elastic_security-create-or-update-case` — Create or Update Case (Write)

Create a new Elastic Security case, or update an existing one when caseId is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or status. When caseId is provided, the tool fetches the case's…

Full schema: https://pipedream.com/apps/elastic-security/actions/create-or-update-case.md

### `elastic_security-create-or-update-detection-rule` — Create or Update Detection Rule (Write)

Create a new Elastic Security detection rule via POST /api/detection_engine/rules, or full-replace update an existing one when id is provided, via PUT /api/detection_engine/rules. On update, the tool first fetches the rule's current definition and merges your supplied fields into it, so you only…

Full schema: https://pipedream.com/apps/elastic-security/actions/create-or-update-detection-rule.md

### `elastic_security-delete-record` — Delete Record (Write)

Permanently delete an Elastic Security case or detection rule by ID. Cases are deleted via DELETE /api/cases; detection rules via DELETE /api/detection_engine/rules. Run Find Cases or Find Detection Rules first to obtain a valid ID for the object you want to delete. Example: calling with…

Full schema: https://pipedream.com/apps/elastic-security/actions/delete-record.md

### `elastic_security-find-assignable-users` — Find Assignable Users (Read-only)

List users who have created or reported Elastic Security cases, via GET /api/cases/reporters, to discover valid profile_uid values for the assignees parameter on Create or Update Case. Kibana has no public endpoint for listing every org user or for listing who is eligible for assignment — this…

Full schema: https://pipedream.com/apps/elastic-security/actions/find-assignable-users.md

### `elastic_security-find-cases` — Find Cases (Read-only)

Find and list Elastic Security cases via GET /api/cases/_find, or fetch a single case directly via GET /api/cases/{caseId} when caseId is provided. Use this to search/browse cases, or to look up one case's full details (including its version token) once you have an ID. Run this first to obtain a…

Full schema: https://pipedream.com/apps/elastic-security/actions/find-cases.md

### `elastic_security-find-detection-rules` — Find Detection Rules (Read-only)

Find and list Elastic Security detection rules via GET /api/detection_engine/rules/_find, or fetch a single rule directly via GET /api/detection_engine/rules when id or ruleId is provided. Use this to search/browse rules, or to look up one rule's full definition once you have an ID. Run this first…

Full schema: https://pipedream.com/apps/elastic-security/actions/find-detection-rules.md

### `elastic_security-list-tags` — List Tags (Read-only)

List all unique tags currently in use across Elastic Security cases via GET /api/cases/tags, or detection rules via GET /api/detection_engine/tags. Use this before tagging a case or rule so you reuse an existing tag instead of creating a near-duplicate (e.g. incident-response vs…

Full schema: https://pipedream.com/apps/elastic-security/actions/list-tags.md

### `elastic_security-run-detection-rule` — Run Detection Rule (Write)

Manually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk action run). Use this to test a rule immediately instead of waiting for its next scheduled interval, or to backfill detections over a past window. Provide the rule ids…

Full schema: https://pipedream.com/apps/elastic-security/actions/run-detection-rule.md

### `elastic_security-search-alerts` — Search Alerts (Read-only)

Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status, or to investigate alert volume/details for a case. Returns the raw Elasticsearch search response with a…

Full schema: https://pipedream.com/apps/elastic-security/actions/search-alerts.md

### `elastic_security-update-alert-status` — Update Alert Status (Write)

Set the workflow status of one or more Elastic Security alerts (signals) by ID via POST /api/detection_engine/signals/status. Run Search Alerts first to obtain signal IDs. Example: calling with alertStatus: "closed", signalIds: ["abc123"], reason: "false_positive" returns { updated: 1…

Full schema: https://pipedream.com/apps/elastic-security/actions/update-alert-status.md

---

- All apps: https://pipedream.com/apps — index: https://pipedream.com/llms.txt
- Pipedream docs for agents: https://pipedream.com/docs/llms.txt