Elastic Security
Business appsAPI keyConnection test available
Cases, case comments and Kibana connectors in Elastic Security.
OCNORA ships 23 typed Elastic Security operations. Each node has a schema-driven form, input and output tables beside its settings, and is pre-flighted by Workflow Health before your first real run. Endpoints not covered by a typed node are called at https://{kibana_url} through the HTTP node with the same credential.
Before you connect Elastic Security
- Authentication
- API key
- Credential
- the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
- Connection test
- Available: the stored credential can be checked against the provider when you add it. This is not a record that a test was run or passed.
What you can do with Elastic Security
Operations, grouped by what they do to your data.
Create and send 4
Read and search 10
Delete and cancel 4
Other operations 2
A sample Elastic Security workflow
- 1A core triggerStart the run from a chat, form, manual, schedule, webhook, workflow trigger — no Elastic Security trigger is needed.
- 2Get Case Activityelastic_security.find_case_activityPage through a case's audit trail of user actions and status changes.
- 3Add Case Commentelastic_security.add_commentAdd an analyst comment to a case, in Markdown.
An outline built from this provider’s node contracts, not a recorded run. Each step’s output fields are available to the next in the field picker.
Every node below has a reference page: what it does, the connection it needs, its config fields with types, constraints and examples, and the shapes it emits.
Operations 23
- Add Case CommentAdd an analyst comment to a case, in Markdown.elastic_security.add_comment
- Attach Alert To CaseAttach one or more detection alerts to a case as an alert attachment.elastic_security.attach_alert
- Create CaseOpen a new case in Elastic Security, optionally attached to a connector.elastic_security.create_case
- Create ConnectorCreate a Kibana connector so cases and rules can reach another system.elastic_security.create_connector
- Delete All Case CommentsDelete every comment and alert attachment on a case in one call.elastic_security.delete_all_comments
- Delete CasesPermanently delete one or more cases and everything attached to them.elastic_security.delete_cases
- Delete Case CommentDelete one comment or alert attachment from a case.elastic_security.delete_comment
- Delete ConnectorDelete a Kibana connector. Rules and cases still referencing it break.elastic_security.delete_connector
- Get Case ActivityPage through a case's audit trail of user actions and status changes.elastic_security.find_case_activity
- List Case ConnectorsList the connectors a case can actually be pushed through.elastic_security.find_case_connectors
- Search CasesSearch cases by text, status, severity, tags, assignee or date range.elastic_security.find_cases
- Search Case CommentsPage through the comments and alerts attached to a case.elastic_security.find_comments
- Get CaseRetrieve one case by its identifier. Comments are fetched separately.elastic_security.get_case
- Get Case CommentRetrieve one comment or alert attachment from a case.elastic_security.get_comment
- Get ConnectorRetrieve one Kibana connector by its identifier.elastic_security.get_connector
- List Case TagsList every tag currently in use across the cases the key can read.elastic_security.list_case_tags
- List Connector TypesList the connector types this deployment's licence and config allow.elastic_security.list_connector_types
- List ConnectorsList every Kibana connector available in the space.elastic_security.list_connectors
- Push Case To ConnectorPush a case to its external service so the incident is opened or updated in Jira, ServiceNow, Swimlane or a case webhook.elastic_security.push_case
- Run ConnectorRun a Kibana connector with the parameters its type expects, for example to post a Slack message or open a ServiceNow incident.elastic_security.run_connector
- Update CaseChange a case's status, severity, assignees or text. The version from the last read is required, so a concurrent edit is rejected rather than lost.elastic_security.update_case
- Update Case CommentReplace the text of a case comment. Elastic refuses partial updates, so the comment's version token from the last read is required.elastic_security.update_comment
- Update ConnectorReplace a Kibana connector's name, configuration and credentials. The body replaces rather than merges, so send the whole configuration.elastic_security.update_connector
Elastic Security questions
- How does OCNORA authenticate with Elastic Security?
- With a stored API key credential, shaped the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}. A connection test can check it when you add it.
- What can I automate with Elastic Security?
- 23 typed operations, each with a reference page listing its config fields and the shapes it emits.
- What if the Elastic Security operation I need is not listed?
- Call https://{kibana_url} from the HTTP node with the same credential, or describe the step to the AI builder, which asks our team for a typed node when one is missing.
- Are there templates that use Elastic Security?
- Not yet. Start from a blank workflow, or describe the workflow to Build with AI.
- How are Elastic Security calls controlled?
- Every call and every run step is audited, runs count against the execution budget, and Workflow Health pre-flights the workflow when you save it.
More in Business apps
See your first Elastic Security workflow run.
Book a technical demo. We add the connection, pick a template or describe the workflow to Build with AI, and Workflow Health checks it before it runs.