Elastic Security ACTION
Create or Update Case
Create a new Elastic Security case, or update an existing one when
caseId is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or status. When caseId is provided, the tool fetches the case's current version internally before updating — never guess or supply a version yourself. Run Find Cases first to obtain a caseId for updates. Use Add Case Comment to attach comments instead of this tool. title and description are required when creating (no caseId). Example: calling with title: "Perimeter Breach", description: "...", severity: "high" returns { id: "a1c1...", title: "Perimeter Breach", status: "open", version: "Wzc1LDFd", ... }; calling again with that caseId and status: "closed" returns the same case updated. See the create documentation and the update documentation- Action
- Writes data
- API key
- SDK
- MCP
IMPLEMENTATION
Call this tool
Connect a user's Elastic Security account once, then configure and run Create or Update Case from your backend or agent.
import { PipedreamClient } from "@pipedream/sdk"
const pd = new PipedreamClient({
projectId: process.env.PIPEDREAM_PROJECT_ID!,
clientId: process.env.PIPEDREAM_CLIENT_ID!,
clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
projectEnvironment: "production",
})
const result = await pd.actions.run({
id: "elastic_security-create-or-update-case",
externalUserId: "{external_user_id}", // any stable ID for this user in your system
configuredProps: {
elastic_security: { authProvisionId: "apn_xxxxxxx" },
caseId: "Case ID",
title: "Title",
},
})
console.log(result)curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
-H "Content-Type: application/json" \
-H "X-PD-Environment: production" \
-H "Authorization: Bearer {access_token}" \
-d '{
"external_user_id": "{external_user_id}",
"id": "elastic_security-create-or-update-case",
"configured_props": {
"elastic_security": { "authProvisionId": "apn_xxxxxxx" },
"caseId": "Case ID",
"title": "Title"
}
}'// accessToken: mint a short-lived token with the Connect SDK — see the MCP guide
const transport = new StreamableHTTPClientTransport(
new URL("https://remote.mcp.pipedream.net/v3"),
{
requestInit: {
headers: {
Authorization: `Bearer ${accessToken}`,
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
"x-pd-app-slug": "elastic_security",
},
},
},
)
const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)
const { tools } = await mcp.listTools()
// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
name: "elastic_security-create-or-update-case",
arguments: {
caseId: "Case ID",
title: "Title",
},
})SCHEMA
Inputs
Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.
| Property | Type | Description |
|---|---|---|
caseId Case ID | string | The ID of an existing case to update. Omit this to create a new case instead. Run Find Cases first to obtain valid case IDs. Optional |
title Title | string | Case title (max 160 characters). Required when creating a new case (no caseId). Optional |
description Description | string | Case description (max 30000 characters). Required when creating a new case (no caseId). Optional |
severity Severity | string | Case severity. One of: low, medium, high, critical. Optional |
status Status | string | New case status. Only applies when updating an existing case ( caseId provided) — the create API has no status field. Optional |
tags Tags | string[] | Tags to apply to the case. Run List Tags first to reuse existing tags instead of creating near-duplicates. On update, this replaces the case's existing tag set entirely. Optional |
category Category | string | Case category (max 50 characters). Optional |
assignees Assignees | string[] | User profile IDs to assign to the case (max 10). Example: ["u_abc123"]. Run Find Assignable Users first to discover valid profile_uid values. On update, this replaces the case's existing assignee set entirely. Optional |
syncAlerts Sync Alerts | boolean | Whether to sync the status of attached alerts with the case status. Defaults to true on create. Optional |
REFERENCE
Tool details
Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.
- Registry key
- elastic_security-create-or-update-case
- Version
- 0.0.1
- App
- Elastic Security
- Authentication
- API key
- Read-only
- No
- Destructive
- No
- Open world
- Yes
- Source
- View on GitHub ↗