View as Markdown
Elastic Security icon

Elastic Security ACTION

Delete Record

Permanently delete an Elastic Security case or detection rule by ID. Cases are deleted via DELETE /api/cases; detection rules via DELETE /api/detection_engine/rules. Run Find Cases or Find Detection Rules first to obtain a valid ID for the object you want to delete. Example: calling with objectType: "case" and recordId: "a1c1..." returns { success: true, objectType: "case", recordId: "a1c1..." }. This is destructive and cannot be undone. See the delete case documentation and the delete rule documentation
  • Action
  • Writes data
  • Destructive
  • API key
  • SDK
  • MCP

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run Delete Record from your backend or agent.

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-delete-record",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    objectType: "Object Type",
    recordId: "Record ID",
  },
})

console.log(result)

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

Delete Record inputs
Property Type Description
objectType Object Type string
The type of object to delete.
Required
recordId Record ID string
The ID of the object to delete. For a case, its case ID from Find Cases (e.g. a1c10c9b-8448-483a-81f7-a4b3225eb6b8). For a detection rule, its Kibana internal UUID from Find Detection Rules' id field (e.g. 7ac3c66d-f0b4-4f7c-a576-7bb91bf4e9ce) — not the user-defined rule_id.
Required

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key
elastic_security-delete-record
Version
0.0.1
App
Elastic Security
Authentication
API key
Read-only
No
Destructive
Yes
Open world
Yes