Get Case
elastic_security.get_case
ActionBusiness appsconnection required
Calls the Elastic Security API with the connection's credentials.
Retrieve one case by its identifier. Comments are fetched separately.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- Elastic Security
- Secret shape
- the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
- Config it needs
- kibana_url, space_id, owner
- Resolved by
- config.connection_id, else node.connection_id
Configuration
1 field, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
case_id Identifier of the case, as returned by Create Case or Search Cases. | string | Yes | — | — | 1b4f9a10-8c2e-11ee-9c3a-0242ac120002 |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
id Identifier of the case. | string | — |
version Concurrency token; pass it back to Update Case. | string | — |
title Title of the case. | string | — |
description Markdown description of the case. | string | — |
status Lifecycle state: open, in-progress or closed. | string | — |
severity Severity: low, medium, high or critical. | string | — |
owner Application that owns the case. | string | — |
tags Tags applied to the case. | array | — |
category Category of the case, or null when unset. | string | — |
assignees User profiles assigned to the case, each with a uid. | array | — |
connector External connector configured on the case. | object | — |
settings Case settings, including the syncAlerts flag. | object | — |
external_service Details of the pushed incident, or null. | object | — |
totalComment How many user comments the case holds. | number | — |
totalAlerts How many alerts are attached to the case. | number | — |
duration Seconds the case stayed open, or null while open. | number | — |
created_at When the case was created, as an ISO 8601 timestamp. | string | — |
created_by The user who created the case. | object | — |
updated_at When the case last changed, or null. | string | — |
closed_at When the case was closed, or null. | string | — |
{
"assignees": [],
"category": "",
"closed_at": "",
"connector": {},
"created_at": "",
"created_by": {},
"description": "",
"duration": 0,
"external_service": {},
"id": "",
"owner": "",
"settings": {},
"severity": "",
"status": "",
"tags": [],
"title": "",
"totalAlerts": 0,
"totalComment": 0,
"updated_at": "",
"version": ""
}See Get Case run in a workflow.
In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.