Elastic Security

Open a new security incident case in Elastic Security, capturing the title, description, severity, and assignees so the team has a single source of truth from the first alert.

Permanently remove a closed or duplicate security case from Elastic Security, keeping the incident queue clean and auditable.

Fetch the full details of a specific Elastic Security case — status, severity, assignees, tags, and timestamps — so the agent can act on current state before making changes.

Pull the full list of Elastic Security cases — filterable by status, severity, or tag — giving the agent a complete picture of the incident queue in one call.

Fetch a condensed activity timeline for all cases — comments, status changes, and tag edits — so the agent can audit history without reading every individual case record.

Modify an existing Elastic Security case — change its status, severity, title, description, or assignee — as the investigation evolves without leaving the case stale.

Post a timestamped comment to an Elastic Security case, capturing investigation notes, tool outputs, or automated findings directly in the incident thread.

Retrieve the text and metadata of a specific comment within a case, letting the agent reference exact prior notes before posting a follow-up or triggering a downstream action.

Pull every comment from a case in chronological order, giving the agent the complete investigation thread needed to draft summaries, extract IOCs, or hand off context.

Delete a specific comment from an Elastic Security case to remove erroneous data, accidental PII exposure, or test entries before they pollute the audit trail.

Edit the body of an existing case comment — to correct a finding, add new evidence, or redact a typo — without breaking the case's comment thread continuity.

Attach a classification tag to an Elastic Security case — such as a threat actor name, attack vector, or compliance framework — enabling precise filtering and reporting across the incident queue.

Strip an outdated or incorrectly applied tag from an Elastic Security case, keeping the classification taxonomy clean as investigations evolve.

Configure a new third-party action connector in Elastic Security — linking to a ticketing system, notification channel, or ITSM platform — so case actions can fan out to external tools automatically.

Retrieve the full catalog of detection rules in Elastic Security — including names, severity, enabled status, and rule types — so the agent can audit coverage gaps or sync rule state across environments.

Fires the moment an Elastic Security detection rule matches — new alert in queue, scoped to rule name, severity, and affected host.

Fires when an existing Elastic Security alert has its severity upgraded — for example from Medium to High or High to Critical — signalling that new evidence has worsened the picture.

Fires whenever a new investigation case is opened in Elastic Security — whether by a human analyst, an automated rule, or an API call — providing an integration hook from the moment the incident is tracked.

Fires whenever a case moves between statuses — Open, In Progress, or Closed — enabling the agent to react at each milestone of the investigation lifecycle.

Fires when an Elastic Endpoint agent stops reporting telemetry — indicating the host may be compromised, shut down, or the agent uninstalled.

Fires when Elastic Security matches an ingested threat intelligence indicator — IP, domain, file hash, or URL — against observed activity in your environment.