<!-- BusyBot node reference — https://busybot.net/tools/elastic-security/ -->

> Node: Elastic Security (`elastic_security`) · Action · v1
> Category: Productivity · Credentials: Elastic Security API (`elasticSecurityApi`)
> Updated: 2026-08-16

# Elastic Security

> Manage Elastic Security cases, comments, tags, and connectors.

## Overview

Elastic Security tool integrates with the Elastic Security (Kibana) Cases API. Supports 4 resources: case (create, delete, get, getAll, getStatus, update), caseComment (add, get, getAll, remove, update), caseTag (add, remove), connector (create). Authentication supports Basic Auth (username/password) or API Key. The API base URL is the Kibana endpoint (e.g. https://kibana.example.com). All mutating operations require the kbn-xsrf: true header. Update operations use read-modify-write with version-based optimistic concurrency control.

**Category:** Productivity  
**Tool Name:** `elastic_security`  
**Version:** 1

**Appearance:** Icon: `lucide-ShieldCheck` | Color: `#FEC514`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Elastic Security API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/elastic-security-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Case | `case` |
| Case Comment | `caseComment` |
| Case Tag | `caseTag` |
| Connector | `connector` |

### Operations

Each resource has its own Operation list, and several resources reuse the same operation values (`get`, `getAll`, `add`, `remove`, `update`). Pick the resource first, then the operation.

| Resource | Operation | Value | Description |
|----------|-----------|-------|-------------|
| Case | Create | `create` | Create a case. |
| Case | Delete | `delete` | Delete a case. |
| Case | Get | `get` | Get a case. |
| Case | Get Many | `getAll` | Retrieve many cases. |
| Case | Get Status | `getStatus` | Retrieve a summary of all case activity. |
| Case | Update | `update` | Update a case. |
| Case Comment | Add | `add` | Add a comment to a case. |
| Case Comment | Get | `get` | Get a case comment. |
| Case Comment | Get Many | `getAll` | Retrieve many case comments. |
| Case Comment | Remove | `remove` | Remove a comment from a case. |
| Case Comment | Update | `update` | Update a comment in a case. |
| Case Tag | Add | `add` | Add a tag to a case. |
| Case Tag | Remove | `remove` | Remove a tag from a case. |
| Connector | Create | `create` | Create a connector. |

### Parameters

`Case: Get Status` takes no parameters of its own — see All Operations.

#### Case: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Title | `string` | Yes | — | Title of the case. |
| Connector ID | `string` | Yes | — | ID of the connector to use for this case (ServiceNow, Jira, or IBM Resilient). |
| Connector Type | `options` | Yes | `.jira` | Type of the connector. Must match the actual connector type — the node reads the connector first and fails the item if the types differ. |
| | | | | Options: `.resilient`, `.jira`, `.servicenow` |
| Issue Type | `string` | Yes | — | Type of the Jira issue to create for this case. _(shown when Connector Type is `.jira`)_ |
| Priority | `string` | Yes | — | Priority of the Jira issue to create for this case. _(shown when Connector Type is `.jira`)_ |
| Urgency | `options` | Yes | `1` | Urgency of the ServiceNow ITSM issue to create for this case. _(shown when Connector Type is `.servicenow`)_ |
| | | | | Options: `1` (Low), `2` (Medium), `3` (High) |
| Severity | `options` | Yes | `1` | Severity of the ServiceNow ITSM issue to create for this case. _(shown when Connector Type is `.servicenow`)_ |
| | | | | Options: `1` (Low), `2` (Medium), `3` (High) |
| Impact | `options` | Yes | `1` | Impact of the ServiceNow ITSM issue to create for this case. _(shown when Connector Type is `.servicenow`)_ |
| | | | | Options: `1` (Low), `2` (Medium), `3` (High) |
| Category | `string` | Yes | — | Category of the ServiceNow ITSM issue to create for this case. _(shown when Connector Type is `.servicenow`)_ |
| Issue Types | `string` | Yes | — | Comma-separated list of numerical types of the IBM Resilient issue to create for this case. _(shown when Connector Type is `.resilient`)_ |
| Severity Code | `number` | Yes | `1` | Severity code of the IBM Resilient issue to create for this case. _(shown when Connector Type is `.resilient`)_ |
| Additional Fields | `collection` | No | `{}` | Optional properties to set on the new case. |
| — Description (`description`) | `string` | No | — | Description of the case. |
| — Owner (`owner`) | `string` | No | — | Valid application owner registered within the Cases RBAC system. Defaults to securitySolution. |
| — Sync Alerts (`syncAlerts`) | `boolean` | No | `false` | Whether to synchronize with alerts. |

#### Case: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to delete. |

#### Case: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to retrieve. |

#### Case: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Narrow the listing. Only the filters you add are sent. |
| — Status (`status`) | `options` | No | `open` | Filter cases by status. |
| | | | | Options: `open`, `in-progress`, `closed` |
| — Tags (`tags`) | `string` | No | — | Comma-separated list of tags to filter by. |
| — Owner (`owner`) | `string` | No | — | Filter by case owner application. |
| Sort Options | `collection` | No | `{}` | How to order the listing. |
| — Sort Field (`sortField`) | `options` | No | `createdAt` | Field to sort results by. |
| | | | | Options: `createdAt`, `updatedAt` |
| — Sort Order (`sortOrder`) | `options` | No | `asc` | Sort direction. |
| | | | | Options: `asc`, `desc` |

#### Case: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to update. |
| Update Fields | `collection` | No | `{}` | Fields to change. Add at least one — the item fails if this is empty. |
| — Description (`description`) | `string` | No | — | New description for the case. |
| — Status (`status`) | `options` | No | `open` | New status for the case. |
| | | | | Options: `open`, `in-progress`, `closed` |
| — Sync Alerts (`syncAlerts`) | `boolean` | No | `false` | Whether to synchronize with alerts. |
| — Title (`title`) | `string` | No | — | New title for the case. |

#### Case Comment: Add

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to add a comment to. |
| Comment | `string` | Yes | — | Text content of the comment. |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |
| Additional Fields | `collection` | No | `{}` | Optional properties to set on the comment. |
| — Owner (`owner`) | `string` | No | — | Valid application owner registered within the Cases RBAC system. |

#### Case Comment: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case containing the comment. |
| Comment ID | `string` | Yes | — | ID of the comment to retrieve. |

#### Case Comment: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to list comments for. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Case Comment: Remove

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case containing the comment to remove. |
| Comment ID | `string` | Yes | — | ID of the comment to remove. |

#### Case Comment: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case containing the comment. |
| Comment ID | `string` | Yes | — | ID of the comment to update. |
| Comment | `string` | Yes | — | Replacement text for the comment. |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |

#### Case Tag: Add

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to add the tag to. |
| Tag | `string` | Yes | — | Tag to attach to the case. The item fails if the case already carries this tag. |

#### Case Tag: Remove

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case to remove the tag from. |
| Tag | `string` | Yes | — | Tag to remove from the case. The item fails if the case does not carry this tag. |

#### Connector: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Connector Name (`name`) | `string` | Yes | — | Display name for the connector. |
| Connector Type | `options` | Yes | `.jira` | Type of the connector to create. |
| | | | | Options: `.resilient`, `.jira`, `.servicenow` |
| API URL | `string` | Yes | — | URL of the third-party instance (Jira, ServiceNow, or IBM Resilient). |
| Email | `string` | Yes | — | Jira-registered email address. _(shown when Connector Type is `.jira`)_ |
| API Token | `string` | Yes | — | Jira API token. Stored as a password field. _(shown when Connector Type is `.jira`)_ |
| Project Key | `string` | Yes | — | Jira project key. _(shown when Connector Type is `.jira`)_ |
| Username | `string` | Yes | — | ServiceNow ITSM username. _(shown when Connector Type is `.servicenow`)_ |
| Password | `string` | Yes | — | ServiceNow ITSM password. Stored as a password field. _(shown when Connector Type is `.servicenow`)_ |
| API Key ID | `string` | Yes | — | IBM Resilient API key ID. Stored as a password field. _(shown when Connector Type is `.resilient`)_ |
| API Key Secret | `string` | Yes | — | IBM Resilient API key secret. Stored as a password field. _(shown when Connector Type is `.resilient`)_ |
| Organization ID | `string` | Yes | — | IBM Resilient organization ID. _(shown when Connector Type is `.resilient`)_ |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `5` | Maximum number of items to process concurrently (1–20). |

## Output Data

Every operation **merges the Kibana response onto the input item's JSON** — the fields the item already carried survive, and a response key with the same name overwrites the item's value. Binary data on the input item is forwarded unchanged.

The number of output items follows the shape of the reply: **an array reply fans out to one output item per entry**, and any other reply produces exactly one output item.

| Operation | Output |
|-----------|--------|
| Case Get Many, Case Comment Get Many | One output item per case or comment. **A listing that matches nothing produces no output items at all**, so that branch of the workflow simply stops. |
| Case Get, Case Get Status, Connector Create | One output item carrying the returned object. |
| Case Create | One output item carrying the created case. |
| Case Update, Case Tag Add, Case Tag Remove | The Cases API replies with the updated case records; each one becomes an output item. |
| Case Comment Add, Case Comment Update | With Simplify on (the default), one output item carrying just the comment that was added or changed. With Simplify off, the raw reply is merged instead. |
| Case Delete, Case Comment Remove | One output item carrying `success: true` — these calls confirm the change instead of returning a record. |

## Usage Examples

- Create a new security case linked to a Jira connector
- Get all open security cases filtered by tag
- Add a comment to an existing case
- Update case status to in-progress or closed
- Add or remove tags from a case
- Create a Jira or ServiceNow connector for case syncing

## Example Configuration

Open a case that syncs to Jira:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Security Incident - Suspicious Activity",
    "connectorId": "jira-connector-123",
    "connectorType": ".jira",
    "issueType": "Bug",
    "priority": "High",
    "additionalFields": {
      "description": "Detected unusual network activity from an internal system",
      "owner": "securitySolution",
      "syncAlerts": true
    }
  }
}
```

Open a case that syncs to ServiceNow ITSM:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Data Breach Investigation",
    "connectorId": "servicenow-connector-456",
    "connectorType": ".servicenow",
    "urgency": 3,
    "severity": 2,
    "impact": 3,
    "category": "Security",
    "additionalFields": {
      "description": "Potential data breach requiring immediate investigation",
      "syncAlerts": true
    }
  }
}
```

List the 50 most recent open cases carrying particular tags:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "status": "open",
      "tags": "security,critical"
    },
    "sortOptions": {
      "sortField": "createdAt",
      "sortOrder": "desc"
    }
  }
}
```

Close a case and stop alert syncing:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "update",
    "caseId": "case-12345",
    "updateFields": {
      "status": "closed",
      "description": "Investigation completed - no security breach found",
      "syncAlerts": false
    }
  }
}
```

Add an investigation note to a case:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "caseComment",
    "operation": "add",
    "caseId": "case-12345",
    "comment": "Investigation revealed no actual breach. False positive from the monitoring system.",
    "simple": true
  }
}
```

Tag a case once it has been triaged:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "caseTag",
    "operation": "add",
    "caseId": "case-12345",
    "tag": "investigated"
  }
}
```

Create a Jira connector:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "connector",
    "operation": "create",
    "name": "Jira Security Connector",
    "connectorType": ".jira",
    "apiUrl": "https://company.atlassian.net",
    "email": "security@company.com",
    "apiToken": "your-jira-api-token",
    "projectKey": "SEC"
  }
}
```

Create a ServiceNow ITSM connector:

```json
{
  "type": "elastic_security",
  "parameters": {
    "resource": "connector",
    "operation": "create",
    "name": "ServiceNow ITSM Connector",
    "connectorType": ".servicenow",
    "apiUrl": "https://company.service-now.com",
    "username": "elastic_user",
    "password": "your-servicenow-password"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage Elastic Security cases, comments, tags, and connectors via the Kibana API.

- **Parameter values are sent literally.** This node does not evaluate `{{ ... }}` expressions in its fields, so a case ID must be typed in rather than read from the incoming item.
- **Connector Type has to match the connector.** On Case Create the node looks the connector up first and fails the item when the selected type differs from the connector's real type, so a case is never opened against the wrong system.
- **Updates are read-modify-write.** Case Update, Case Tag Add and Case Tag Remove each fetch the current record, apply the change and send it back with its version, so two nodes editing the same case at the same time can collide — sequence them rather than running them in parallel.
- **Tag operations are strict.** Adding a tag the case already has, or removing one it does not have, fails that item instead of silently doing nothing.
- **Turn Simplify off when you need the whole case.** On comment Add and Update it is the difference between getting the single comment back and getting the full case record.