Delete Case Comment

elastic_security.delete_comment

ActionBusiness appsconnection required

Calls the Elastic Security API with the connection's credentials.

Delete one comment or alert attachment from a case.

Ask about Elastic Security All Elastic Security nodes Provider API docs ↗

Connection

Required: Yes — the node will not save without one
Auth type: API key
Providers: Elastic Security
Secret shape: the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
Config it needs: kibana_url, space_id, owner
Resolved by: config.connection_id, else node.connection_id

Configuration

2 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
case_id Identifier of the case, as returned by Create Case or Search Cases.	string	Yes	—	—	1b4f9a10-8c2e-11ee-9c3a-0242ac120002
comment_id Identifier of the comment or alert attachment to delete.	string	Yes	—	—	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}

Output

One shape.

result

Field	Type	Example
deleted True when Elastic accepted the deletion.	boolean	—
case_id The case the attachment was removed from.	string	—
comment_id The attachment that was removed.	string	—

{
  "case_id": "",
  "comment_id": "",
  "deleted": false
}

Related Elastic Security nodes

See Delete Case Comment run in a workflow.

In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales