Update Case Comment
elastic_security.update_comment
ActionBusiness appsconnection required
Calls the Elastic Security API with the connection's credentials.
Replace the text of a case comment. Elastic refuses partial updates, so the comment's version token from the last read is required.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- Elastic Security
- Secret shape
- the Kibana API key ("ApiKey <encoded>" or the bare encoded value), or {"api_key": "…"}
- Config it needs
- kibana_url, space_id, owner
- Resolved by
- config.connection_id, else node.connection_id
Configuration
5 fields, 4 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
case_id Identifier of the case, as returned by Create Case or Search Cases. | string | Yes | — | — | 1b4f9a10-8c2e-11ee-9c3a-0242ac120002 |
comment_id Identifier of the comment to replace. | string | Yes | — | — | — |
version The comment's current version token, from Get or Search Case Comments. | string | Yes | — | — | — |
comment The replacement Markdown text, up to 30000 characters. | string | Yes | — | ≤ 30000 characters | — |
owner Application that owns the case. Leave blank to use the connection's owner. | string | No | — | one of "securitySolution", "observability", "cases" | — |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"case_id": "1b4f9a10-8c2e-11ee-9c3a-0242ac120002"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
id Identifier of the comment or alert attachment. | string | — |
version Concurrency token; pass it back to Update Comment. | string | — |
type Attachment type: user for a comment, alert for an alert. | string | — |
comment Comment text, present on a user attachment. | string | — |
owner Application that owns the case this belongs to. | string | — |
created_at When the attachment was added, as an ISO 8601 timestamp. | string | — |
created_by The user who added the attachment. | object | — |
updated_at When the attachment last changed, or null. | string | — |
{
"comment": "",
"created_at": "",
"created_by": {},
"id": "",
"owner": "",
"type": "",
"updated_at": "",
"version": ""
}See Update Case Comment run in a workflow.
In a technical demo we add the Elastic Security connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.