Push Case To Connector

elastic_security.push_case

ActionBusiness appsconnection required

Calls the Elastic Security API with the connection's credentials.

Push a case to its external service so the incident is opened or updated in Jira, ServiceNow, Swimlane or a case webhook.

Ask about Elastic Security All Elastic Security nodes Provider API docs ↗

Connection

Required: Yes — the node will not save without one
Auth type: API key
Providers: Elastic Security
Secret shape: the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
Config it needs: kibana_url, space_id, owner
Resolved by: config.connection_id, else node.connection_id

Configuration

2 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
case_id Identifier of the case, as returned by Create Case or Search Cases.	string	Yes	—	—	1b4f9a10-8c2e-11ee-9c3a-0242ac120002
connector_id Identifier of the Kibana connector to push the case through.	string	Yes	—	—	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}

Output

One shape.

result

Field	Type	Example
case The case as it stands after the push.	object	—
id Identifier of the pushed case.	string	—
version The case's version token after the push.	string	—
pushed True when Elastic recorded an external incident.	boolean	—
external_service The external incident record, or null.	object	—
external_url Link to the incident in the external system.	string	—
external_title The incident's key or title, such as SEC-42.	string	—

{
  "case": {},
  "external_service": {},
  "external_title": "",
  "external_url": "",
  "id": "",
  "pushed": false,
  "version": ""
}

Related Elastic Security nodes

See Push Case To Connector run in a workflow.

In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales