View as Markdown
Elastic Security icon

Elastic Security ACTION

Create or Update Case

Create a new Elastic Security case, or update an existing one when caseId is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or status. When caseId is provided, the tool fetches the case's current version internally before updating — never guess or supply a version yourself. Run Find Cases first to obtain a caseId for updates. Use Add Case Comment to attach comments instead of this tool. title and description are required when creating (no caseId). Example: calling with title: "Perimeter Breach", description: "...", severity: "high" returns { id: "a1c1...", title: "Perimeter Breach", status: "open", version: "Wzc1LDFd", ... }; calling again with that caseId and status: "closed" returns the same case updated. See the create documentation and the update documentation
  • Action
  • Writes data
  • API key
  • SDK
  • MCP

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run Create or Update Case from your backend or agent.

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-create-or-update-case",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    caseId: "Case ID",
    title: "Title",
  },
})

console.log(result)

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

Create or Update Case inputs
Property Type Description
caseId Case ID string
The ID of an existing case to update. Omit this to create a new case instead. Run Find Cases first to obtain valid case IDs.
Optional
title Title string
Case title (max 160 characters). Required when creating a new case (no caseId).
Optional
description Description string
Case description (max 30000 characters). Required when creating a new case (no caseId).
Optional
severity Severity string
Case severity. One of: low, medium, high, critical.
Optional
status Status string
New case status. Only applies when updating an existing case (caseId provided) — the create API has no status field.
Optional
tags Tags string[]
Tags to apply to the case. Run List Tags first to reuse existing tags instead of creating near-duplicates. On update, this replaces the case's existing tag set entirely.
Optional
category Category string
Case category (max 50 characters).
Optional
assignees Assignees string[]
User profile IDs to assign to the case (max 10). Example: ["u_abc123"]. Run Find Assignable Users first to discover valid profile_uid values. On update, this replaces the case's existing assignee set entirely.
Optional
syncAlerts Sync Alerts boolean
Whether to sync the status of attached alerts with the case status. Defaults to true on create.
Optional

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key
elastic_security-create-or-update-case
Version
0.0.1
App
Elastic Security
Authentication
API key
Read-only
No
Destructive
No
Open world
Yes