# Search Alerts — Elastic Security

> Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status, or to investigate alert volume/details for a…

- Key: `elastic_security-search-alerts`
- Type: Action (Read-only)
- Version: 0.0.1
- App: Elastic Security (`elastic_security`) — https://pipedream.com/apps/elastic-security.md
- This page (HTML): https://pipedream.com/apps/elastic-security/actions/search-alerts
- Hints: read-only · open-world
- Source: https://github.com/PipedreamHQ/pipedream/blob/master/components/elastic_security/actions/search-alerts/search-alerts.mjs

## Description

Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running **Update Alert Status**, or to investigate alert volume/details for a case. Returns the raw Elasticsearch search response with a `hits.hits` array; each hit's `_id` is the signal ID and `_source` holds the alert's full ECS document. Example: calling with `query: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}}` and `size: 5` returns `{ hits: { total: { value: 12 }, hits: [{ _id: "abc123", _source: { "@timestamp": "...", "kibana.alert.workflow_status": "open", "host.name": "..." } }, ...] } }`. Omit `query` to match all alerts. `_source` always holds the full ECS document; use `fields` to additionally get a compact, array-valued view of just the fields you need (under each hit's `fields` key) without parsing the full document yourself. [See the documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts)

## Props

| Prop | Type | Required | Description |
|---|---|---|---|
| `query` | `object` | No | Elasticsearch Query DSL object. Example: {"bool":{"filter":[{"term":{"kibana.alert.workflow_status":"open"}}]}}. Omit to match all alerts. |
| `size` | `integer` | No | Maximum number of alerts to return per call. Minimum 0. Defaults to 10. To paginate beyond this limit, increase From by Size on successive calls (e.g. Size=100, From=0 for page 1; From=100 for page 2). |
| `from` | `integer` | No | Zero-based offset of the first alert to return, used for pagination. For example, set Size to 100 and From to 100 to fetch the second page of results. Defaults to 0. |
| `sort` | `object` | No | Elasticsearch sort clause as an object mapping field name to asc/desc (or a sort options object). Example: {"@timestamp":"desc"}. Add more keys to sort by multiple fields. |
| `trackTotalHits` | `boolean` | No | Whether to return an accurate total hit count instead of a bounded estimate. |
| `fields` | `string[]` | No | Request these specific fields via Elasticsearch's native field retrieval, e.g. ["@timestamp", "kibana.alert.workflow_status", "host.name"] — returned under each hit's fields key (each value as an array), alongside the unchanged full _source document. Useful for reading known field values without parsing all of _source. Common fields: @timestamp, kibana.alert.workflow_status, kibana.alert.rule.name, host.name, user.name, event.category. |

## Run it

**MCP**

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "elastic_security-search-alerts",
  arguments: {
    query: "Query",
    size: 10,
  },
})
```

**TypeScript**

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-search-alerts",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    query: "Query",
    size: 10,
  },
})

console.log(result)
```

**cURL**

```bash
curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "elastic_security-search-alerts",
    "configured_props": {
      "elastic_security": { "authProvisionId": "apn_xxxxxxx" },
      "query": "Query",
      "size": 10
    }
  }'
```

---

- App: https://pipedream.com/apps/elastic-security.md · All apps: https://pipedream.com/apps