Security & Identity · CONNECTIONCreate, search, update and delete Elastic Security cases, their comments and tags, and create case connectors through Kibana.
Explore 14 workflow actions for Elastic Security, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Add a user comment to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Add one tag, keeping the case's other tags.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Open a case with a title, description, tags and severity.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create a Kibana connector, such as Jira, ServiceNow or IBM Resilient, for pushing cases.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete a case and its comments.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Read a page of a case's comments.
Search a page of cases by status, severity, tags or text.
Read one case.
Read one comment on a case.
Count open, in-progress and closed cases.
Delete one comment from a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Remove one tag, keeping the case's other tags.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Change a case's title, description, status, severity, tags or category at its current version.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Change a user comment at its current version.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in Elastic Security. A saved workflow is not a completed provider action.
