Attach Alert To Case
elastic_security.attach_alert
ActionBusiness appsconnection required
Calls the Elastic Security API with the connection's credentials.
Attach one or more detection alerts to a case as an alert attachment.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- Elastic Security
- Secret shape
- the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
- Config it needs
- kibana_url, space_id, owner
- Resolved by
- config.connection_id, else node.connection_id
Configuration
6 fields, 3 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
case_id Identifier of the case, as returned by Create Case or Search Cases. | string | Yes | — | — | 1b4f9a10-8c2e-11ee-9c3a-0242ac120002 |
alert_ids Document ids of the alerts to attach, at most 1000 of them. | array | Yes | — | 1–1000 characters; array of string | — |
indices Index each alert lives in. Give one index or one per alert id. | array | Yes | — | ≥ 1 characters; array of string | — |
rule_id Identifier of the detection rule that produced the alerts. | string | No | — | — | — |
rule_name Name of the detection rule that produced the alerts. | string | No | — | — | — |
owner Application that owns the case. Leave blank to use the connection's owner. | string | No | — | one of "securitySolution", "observability", "cases" | — |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
id Identifier of the comment or alert attachment. | string | — |
version Concurrency token; pass it back to Update Comment. | string | — |
type Attachment type: user for a comment, alert for an alert. | string | — |
comment Comment text, present on a user attachment. | string | — |
owner Application that owns the case this belongs to. | string | — |
created_at When the attachment was added, as an ISO 8601 timestamp. | string | — |
created_by The user who added the attachment. | object | — |
updated_at When the attachment last changed, or null. | string | — |
{
"comment": "",
"created_at": "",
"created_by": {},
"id": "",
"owner": "",
"type": "",
"updated_at": "",
"version": ""
}Notes
- Elastic requires one index per alert id; a single index is repeated for every alert, and any other mismatch is refused before the call is made.
See Attach Alert To Case run in a workflow.
In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.