View as Markdown
Elastic Security icon

Elastic Security ACTION

Search Alerts

Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status, or to investigate alert volume/details for a case. Returns the raw Elasticsearch search response with a hits.hits array; each hit's _id is the signal ID and _source holds the alert's full ECS document. Example: calling with query: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}} and size: 5 returns { hits: { total: { value: 12 }, hits: [{ _id: "abc123", _source: { "@timestamp": "...", "kibana.alert.workflow_status": "open", "host.name": "..." } }, ...] } }. Omit query to match all alerts. _source always holds the full ECS document; use fields to additionally get a compact, array-valued view of just the fields you need (under each hit's fields key) without parsing the full document yourself. See the documentation
  • Action
  • Read only
  • API key
  • SDK
  • MCP

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run Search Alerts from your backend or agent.

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-search-alerts",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    query: "Query",
    size: 10,
  },
})

console.log(result)

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

Search Alerts inputs
Property Type Description
query Query object
Elasticsearch Query DSL object. Example: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}}. Omit to match all alerts.
Optional
size Size integer
Maximum number of alerts to return per call. Minimum 0. Defaults to 10. To paginate beyond this limit, increase From by Size on successive calls (e.g. Size=100, From=0 for page 1; From=100 for page 2).
Optional
from From integer
Zero-based offset of the first alert to return, used for pagination. For example, set Size to 100 and From to 100 to fetch the second page of results. Defaults to 0.
Optional
sort Sort object
Elasticsearch sort clause as an object mapping field name to asc/desc (or a sort options object). Example: {"@timestamp":"desc"}. Add more keys to sort by multiple fields.
Optional
trackTotalHits Track Total Hits boolean
Whether to return an accurate total hit count instead of a bounded estimate.
Optional
fields Fields string[]
Request these specific fields via Elasticsearch's native field retrieval, e.g. ["@timestamp", "kibana.alert.workflow_status", "host.name"] — returned under each hit's fields key (each value as an array), alongside the unchanged full _source document. Useful for reading known field values without parsing all of _source. Common fields: @timestamp, kibana.alert.workflow_status, kibana.alert.rule.name, host.name, user.name, event.category.
Optional

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key
elastic_security-search-alerts
Version
0.0.1
App
Elastic Security
Authentication
API key
Read-only
Yes
Destructive
No
Open world
Yes