Elastic Security ACTION
Search Alerts
Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status, or to investigate alert volume/details for a case. Returns the raw Elasticsearch search response with a
hits.hits array; each hit's _id is the signal ID and _source holds the alert's full ECS document. Example: calling with query: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}} and size: 5 returns { hits: { total: { value: 12 }, hits: [{ _id: "abc123", _source: { "@timestamp": "...", "kibana.alert.workflow_status": "open", "host.name": "..." } }, ...] } }. Omit query to match all alerts. _source always holds the full ECS document; use fields to additionally get a compact, array-valued view of just the fields you need (under each hit's fields key) without parsing the full document yourself. See the documentation- Action
- Read only
- API key
- SDK
- MCP
IMPLEMENTATION
Call this tool
Connect a user's Elastic Security account once, then configure and run Search Alerts from your backend or agent.
import { PipedreamClient } from "@pipedream/sdk"
const pd = new PipedreamClient({
projectId: process.env.PIPEDREAM_PROJECT_ID!,
clientId: process.env.PIPEDREAM_CLIENT_ID!,
clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
projectEnvironment: "production",
})
const result = await pd.actions.run({
id: "elastic_security-search-alerts",
externalUserId: "{external_user_id}", // any stable ID for this user in your system
configuredProps: {
elastic_security: { authProvisionId: "apn_xxxxxxx" },
query: "Query",
size: 10,
},
})
console.log(result)curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
-H "Content-Type: application/json" \
-H "X-PD-Environment: production" \
-H "Authorization: Bearer {access_token}" \
-d '{
"external_user_id": "{external_user_id}",
"id": "elastic_security-search-alerts",
"configured_props": {
"elastic_security": { "authProvisionId": "apn_xxxxxxx" },
"query": "Query",
"size": 10
}
}'// accessToken: mint a short-lived token with the Connect SDK — see the MCP guide
const transport = new StreamableHTTPClientTransport(
new URL("https://remote.mcp.pipedream.net/v3"),
{
requestInit: {
headers: {
Authorization: `Bearer ${accessToken}`,
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
"x-pd-app-slug": "elastic_security",
},
},
},
)
const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)
const { tools } = await mcp.listTools()
// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
name: "elastic_security-search-alerts",
arguments: {
query: "Query",
size: 10,
},
})SCHEMA
Inputs
Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.
| Property | Type | Description |
|---|---|---|
query Query | object | Elasticsearch Query DSL object. Example: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}}. Omit to match all alerts. Optional |
size Size | integer | Maximum number of alerts to return per call. Minimum 0. Defaults to 10. To paginate beyond this limit, increase From by Size on successive calls (e.g. Size=100, From=0 for page 1; From=100 for page 2). Optional |
from From | integer | Zero-based offset of the first alert to return, used for pagination. For example, set Size to 100 and From to 100 to fetch the second page of results. Defaults to 0. Optional |
sort Sort | object | Elasticsearch sort clause as an object mapping field name to asc/desc (or a sort options object). Example: {"@timestamp":"desc"}. Add more keys to sort by multiple fields. Optional |
trackTotalHits Track Total Hits | boolean | Whether to return an accurate total hit count instead of a bounded estimate. Optional |
fields Fields | string[] | Request these specific fields via Elasticsearch's native field retrieval, e.g. ["@timestamp", "kibana.alert.workflow_status", "host.name"] — returned under each hit's fields key (each value as an array), alongside the unchanged full _source document. Useful for reading known field values without parsing all of _source. Common fields: @timestamp, kibana.alert.workflow_status, kibana.alert.rule.name, host.name, user.name, event.category. Optional |
REFERENCE
Tool details
Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.
- Registry key
- elastic_security-search-alerts
- Version
- 0.0.1
- App
- Elastic Security
- Authentication
- API key
- Read-only
- Yes
- Destructive
- No
- Open world
- Yes
- Source
- View on GitHub ↗