Elastic Security ACTION

List Tags

List all unique tags currently in use across Elastic Security cases via GET /api/cases/tags, or detection rules via GET /api/detection_engine/tags. Use this before tagging a case or rule so you reuse an existing tag instead of creating a near-duplicate (e.g. incident-response vs. incident_response). Cross-referenced by the tags parameter on Create or Update Case, Create or Update Detection Rule, and Find Cases. Example: calling with objectType: "case" returns ["council-jurassic-eval", "ransomware", "insider-threat"]. See the case tags documentation and the rule tags documentation

Action
Read only
API key
SDK
MCP

Start building

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run List Tags from your backend or agent.

Pipedream Connect

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-list-tags",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    objectType: "Object Type",
  },
})

console.log(result)

curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "elastic_security-list-tags",
    "configured_props": {
      "elastic_security": { "authProvisionId": "apn_xxxxxxx" },
      "objectType": "Object Type"
    }
  }'

// accessToken: mint a short-lived token with the Connect SDK — see the MCP guide
const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": "{project_id}",
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "elastic_security-list-tags",
  arguments: {
    objectType: "Object Type",
  },
})

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

List Tags inputs
Property	Type	Description
`objectType` Object Type	`string`	Whether to list tags used on cases or on detection rules. Required

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key: elastic_security-list-tags
Version: 0.0.1
App: Elastic Security
Authentication: API key
Read-only: Yes
Destructive: No
Open world: Yes
Source: View on GitHub ↗

Call this tool #

Inputs #

Tool details #

Call this tool

Inputs

Tool details