Elastic Security

Operations 23

• Add Case Comment
  Add an analyst comment to a case, in Markdown.
  elastic_security.add_comment
• Attach Alert To Case
  Attach one or more detection alerts to a case as an alert attachment.
  elastic_security.attach_alert
• Create Case
  Open a new case in Elastic Security, optionally attached to a connector.
  elastic_security.create_case
• Create Connector
  Create a Kibana connector so cases and rules can reach another system.
  elastic_security.create_connector
• Delete All Case Comments
  Delete every comment and alert attachment on a case in one call.
  elastic_security.delete_all_comments
• Delete Cases
  Permanently delete one or more cases and everything attached to them.
  elastic_security.delete_cases
• Delete Case Comment
  Delete one comment or alert attachment from a case.
  elastic_security.delete_comment
• Delete Connector
  Delete a Kibana connector. Rules and cases still referencing it break.
  elastic_security.delete_connector
• Get Case Activity
  Page through a case's audit trail of user actions and status changes.
  elastic_security.find_case_activity
• List Case Connectors
  List the connectors a case can actually be pushed through.
  elastic_security.find_case_connectors
• Search Cases
  Search cases by text, status, severity, tags, assignee or date range.
  elastic_security.find_cases
• Search Case Comments
  Page through the comments and alerts attached to a case.
  elastic_security.find_comments
• Get Case
  Retrieve one case by its identifier. Comments are fetched separately.
  elastic_security.get_case
• Get Case Comment
  Retrieve one comment or alert attachment from a case.
  elastic_security.get_comment
• Get Connector
  Retrieve one Kibana connector by its identifier.
  elastic_security.get_connector
• List Case Tags
  List every tag currently in use across the cases the key can read.
  elastic_security.list_case_tags
• List Connector Types
  List the connector types this deployment's licence and config allow.
  elastic_security.list_connector_types
• List Connectors
  List every Kibana connector available in the space.
  elastic_security.list_connectors
• Push Case To Connector
  Push a case to its external service so the incident is opened or updated in Jira, ServiceNow, Swimlane or a case webhook.
  elastic_security.push_case
• Run Connector
  Run a Kibana connector with the parameters its type expects, for example to post a Slack message or open a ServiceNow incident.
  elastic_security.run_connector
• Update Case
  Change a case's status, severity, assignees or text. The version from the last read is required, so a concurrent edit is rejected rather than lost.
  elastic_security.update_case
• Update Case Comment
  Replace the text of a case comment. Elastic refuses partial updates, so the comment's version token from the last read is required.
  elastic_security.update_comment
• Update Connector
  Replace a Kibana connector's name, configuration and credentials. The body replaces rather than merges, so send the whole configuration.
  elastic_security.update_connector