View as Markdown
Elastic Security icon

Elastic Security ACTION

Find Cases

Find and list Elastic Security cases via GET /api/cases/_find, or fetch a single case directly via GET /api/cases/{caseId} when caseId is provided. Use this to search/browse cases, or to look up one case's full details (including its version token) once you have an ID. Run this first to obtain a caseId before using Create or Update Case, Add Case Comment, or Delete Record. Example: calling with search: "perimeter breach" and status: "open" returns { total: 1, cases: [{ id: "a1c1...", title: "Isla Nublar Perimeter Breach", severity: "high", status: "open", ... }] }; use fields to shrink each case down to just the fields you need. See the documentation
  • Action
  • Read only
  • API key
  • SDK
  • MCP

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run Find Cases from your backend or agent.

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-find-cases",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    caseId: "Case ID",
    search: "Search",
  },
})

console.log(result)

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

Find Cases inputs
Property Type Description
caseId Case ID string
Fetch a single case directly by ID instead of searching. When provided, all other search/filter parameters are ignored.
Optional
search Search string
Free-text search string to match against case fields. Ignored when caseId is provided.
Optional
status Status string
Filter by case status. One of: open, in-progress, closed. Ignored when caseId is provided.
Optional
severity Severity string
Filter by case severity. One of: low, medium, high, critical. Ignored when caseId is provided.
Optional
tags Tags string[]
Filter by one or more tags. Run List Tags first to see existing case tags. Ignored when caseId is provided.
Optional
sortField Sort Field string
Field to sort by (e.g. createdAt, updatedAt, severity, status). Ignored when caseId is provided.
Optional
sortOrder Sort Order string
Sort direction: asc or desc. Ignored when caseId is provided.
Optional
page Page integer
Page number of results to return, starting at 1. Defaults to 1. If the response's total field exceeds page × perPage, more results exist — call again with page incremented by 1 to fetch them.
Optional
perPage Per Page integer
Number of results per page. Maximum 100. Defaults to 20. See Page for how to fetch additional pages.
Optional
fields Fields string[]
Only include these fields in each returned case, to reduce response size. Omit to return the full case object(s). Common fields: id, title, description, severity, status, tags, category, assignees, created_at, updated_at, version, totalComment, totalAlerts.
Optional

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key
elastic_security-find-cases
Version
0.0.1
App
Elastic Security
Authentication
API key
Read-only
Yes
Destructive
No
Open world
Yes