Create Case
elastic_security.create_case
ActionBusiness appsconnection required
Calls the Elastic Security API with the connection's credentials.
Open a new case in Elastic Security, optionally attached to a connector.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- Elastic Security
- Secret shape
- the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
- Config it needs
- kibana_url, space_id, owner
- Resolved by
- config.connection_id, else node.connection_id
Configuration
10 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
title Title of the case, up to 160 characters. | string | Yes | — | ≤ 160 characters | Suspicious PowerShell on FIN-WS-04 |
description Markdown description of what happened, up to 30000 characters. | string | Yes | — | ≤ 30000 characters | — |
tags Tags to file the case under, as a list or a comma-separated string. | array | No | — | array of string | — |
severity Severity of the case. Elastic defaults it to low when omitted. | string | No | — | one of "low", "medium", "high", "critical" | — |
category Category of the case, up to 50 characters. | string | No | — | ≤ 50 characters | — |
assignees User profile uids to assign, at most 10 of them. | array | No | — | ≤ 10 characters; array of string | — |
connector External connector for the case as {id, name, type, fields}. Left blank the case is created with no connector attached. | object | No | — | — | — |
custom_fields Custom field values as a list of {key, type, value} objects. | array | No | — | array of object | — |
sync_alerts Keep the status of attached alerts in step with the case. | boolean | No | true | — | — |
owner Application that owns the case. Leave blank to use the connection's owner. | string | No | — | one of "securitySolution", "observability", "cases" | — |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"sync_alerts": true,
"title": "Suspicious PowerShell on FIN-WS-04"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
id Identifier of the case. | string | — |
version Concurrency token; pass it back to Update Case. | string | — |
title Title of the case. | string | — |
description Markdown description of the case. | string | — |
status Lifecycle state: open, in-progress or closed. | string | — |
severity Severity: low, medium, high or critical. | string | — |
owner Application that owns the case. | string | — |
tags Tags applied to the case. | array | — |
category Category of the case, or null when unset. | string | — |
assignees User profiles assigned to the case, each with a uid. | array | — |
connector External connector configured on the case. | object | — |
settings Case settings, including the syncAlerts flag. | object | — |
external_service Details of the pushed incident, or null. | object | — |
totalComment How many user comments the case holds. | number | — |
totalAlerts How many alerts are attached to the case. | number | — |
duration Seconds the case stayed open, or null while open. | number | — |
created_at When the case was created, as an ISO 8601 timestamp. | string | — |
created_by The user who created the case. | object | — |
updated_at When the case last changed, or null. | string | — |
closed_at When the case was closed, or null. | string | — |
{
"assignees": [],
"category": "",
"closed_at": "",
"connector": {},
"created_at": "",
"created_by": {},
"description": "",
"duration": 0,
"external_service": {},
"id": "",
"owner": "",
"settings": {},
"severity": "",
"status": "",
"tags": [],
"title": "",
"totalAlerts": 0,
"totalComment": 0,
"updated_at": "",
"version": ""
}See Create Case run in a workflow.
In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.