Get Case Comment

elastic_security.get_comment

ActionBusiness appsconnection required

Calls the Elastic Security API with the connection's credentials.

Retrieve one comment or alert attachment from a case.

Ask about Elastic Security All Elastic Security nodes Provider API docs ↗

Connection

Required: Yes — the node will not save without one
Auth type: API key
Providers: Elastic Security
Secret shape: the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
Config it needs: kibana_url, space_id, owner
Resolved by: config.connection_id, else node.connection_id

Configuration

2 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
case_id Identifier of the case, as returned by Create Case or Search Cases.	string	Yes	—	—	1b4f9a10-8c2e-11ee-9c3a-0242ac120002
comment_id Identifier of the comment or alert attachment.	string	Yes	—	—	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}

Output

One shape.

result

Field	Type	Example
id Identifier of the comment or alert attachment.	string	—
version Concurrency token; pass it back to Update Comment.	string	—
type Attachment type: user for a comment, alert for an alert.	string	—
comment Comment text, present on a user attachment.	string	—
owner Application that owns the case this belongs to.	string	—
created_at When the attachment was added, as an ISO 8601 timestamp.	string	—
created_by The user who added the attachment.	object	—
updated_at When the attachment last changed, or null.	string	—

{
  "comment": "",
  "created_at": "",
  "created_by": {},
  "id": "",
  "owner": "",
  "type": "",
  "updated_at": "",
  "version": ""
}

Related Elastic Security nodes

See Get Case Comment run in a workflow.

In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales