What credentials do I need, and where do I get them?

You need an Elastic Security API credential, which accepts either a username/password pair (Basic Auth) or an API Key. The base URL you provide should be your Kibana endpoint — for example, https://kibana.example.com — not the Elasticsearch data node. Create the credential once in BusyBot and reuse it across all Elastic Security nodes in your workspace.

Can I use a variable or expression to pass a case ID dynamically?

No. This node does not evaluate {{ ... }} template expressions in its fields — values are sent exactly as typed. If you need to act on a specific case, you must enter the case ID as a literal value in the node's configuration. To work around this for dynamic IDs, use a preceding workflow step that resolves the ID, then hard-code the result before it reaches this node.

Why did my Case Update fail even though I had the correct case ID?

Case Update, Tag Add, and Tag Remove all use a read-modify-write pattern: the node first fetches the current record, applies your change, then sends the update back with the record's current version number. If another process updated the same case between the fetch and the write, the version won't match and the operation fails. Avoid running two nodes that edit the same case in parallel — sequence them instead.

What happens if I try to add a tag that already exists, or remove one that isn't there?

Both operations are strict: adding a tag the case already has will fail that item, and removing a tag the case does not have will also fail it. Neither operation silently does nothing. If you're unsure of the current tag state, use a Case Get step first to inspect the existing tags before attempting a Tag Add or Tag Remove.

The comment Add operation returned only the comment, but I need the full case record. How do I get it?

By default, the comment Add and Update operations return only the affected comment. Turn the Simplify option off in the node's settings to receive the full case record in the response instead. The same toggle applies to comment Update.

How does the node handle connector type mismatches when creating a case?

When you create a case and specify a connector, the node looks up that connector first and checks whether its type matches what you've selected in the node's Connector Type field. If they differ, the node fails that item immediately rather than opening a case wired to the wrong external system. Make sure the Connector Type you select in BusyBot matches the actual type of the connector in Kibana.

Elastic Security

Manage Elastic Security cases, comments, tags, and connectors.

Overview

Elastic Security tool integrates with the Elastic Security (Kibana) Cases API. Supports 4 resources: case (create, delete, get, getAll, getStatus, update), caseComment (add, get, getAll, remove, update), caseTag (add, remove), connector (create). Authentication supports Basic Auth (username/password) or API Key. The API base URL is the Kibana endpoint (e.g. https://kibana.example.com). All mutating operations require the kbn-xsrf: true header. Update operations use read-modify-write with version-based optimistic concurrency control.

Category: Productivity
Tool Name: elastic_security
Version: 1

Appearance: Icon: lucide-ShieldCheck | Color: #FEC514

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	`Input`
Output	`Output`, `Error`

Credentials

This tool requires Elastic Security API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Case	`case`
Case Comment	`caseComment`
Case Tag	`caseTag`
Connector	`connector`

Operations

Each resource has its own Operation list, and several resources reuse the same operation values (get, getAll, add, remove, update). Pick the resource first, then the operation.

Resource	Operation	Value	Description
Case	Create	`create`	Create a case.
Case	Delete	`delete`	Delete a case.
Case	Get	`get`	Get a case.
Case	Get Many	`getAll`	Retrieve many cases.
Case	Get Status	`getStatus`	Retrieve a summary of all case activity.
Case	Update	`update`	Update a case.
Case Comment	Add	`add`	Add a comment to a case.
Case Comment	Get	`get`	Get a case comment.
Case Comment	Get Many	`getAll`	Retrieve many case comments.
Case Comment	Remove	`remove`	Remove a comment from a case.
Case Comment	Update	`update`	Update a comment in a case.
Case Tag	Add	`add`	Add a tag to a case.
Case Tag	Remove	`remove`	Remove a tag from a case.
Connector	Create	`create`	Create a connector.

Parameters

Case: Get Status takes no parameters of its own — see All Operations.

Case: Create

Parameter	Type	Required	Default	Description
Title	`string`	Yes	—	Title of the case.
Connector ID	`string`	Yes	—	ID of the connector to use for this case (ServiceNow, Jira, or IBM Resilient).
Connector Type	`options`	Yes	`.jira`	Type of the connector. Must match the actual connector type — the node reads the connector first and fails the item if the types differ.
				Options: `.resilient`, `.jira`, `.servicenow`
Issue Type	`string`	Yes	—	Type of the Jira issue to create for this case. (shown when Connector Type is `.jira`)
Priority	`string`	Yes	—	Priority of the Jira issue to create for this case. (shown when Connector Type is `.jira`)
Urgency	`options`	Yes	`1`	Urgency of the ServiceNow ITSM issue to create for this case. (shown when Connector Type is `.servicenow`)
				Options: `1` (Low), `2` (Medium), `3` (High)
Severity	`options`	Yes	`1`	Severity of the ServiceNow ITSM issue to create for this case. (shown when Connector Type is `.servicenow`)
				Options: `1` (Low), `2` (Medium), `3` (High)
Impact	`options`	Yes	`1`	Impact of the ServiceNow ITSM issue to create for this case. (shown when Connector Type is `.servicenow`)
				Options: `1` (Low), `2` (Medium), `3` (High)
Category	`string`	Yes	—	Category of the ServiceNow ITSM issue to create for this case. (shown when Connector Type is `.servicenow`)
Issue Types	`string`	Yes	—	Comma-separated list of numerical types of the IBM Resilient issue to create for this case. (shown when Connector Type is `.resilient`)
Severity Code	`number`	Yes	`1`	Severity code of the IBM Resilient issue to create for this case. (shown when Connector Type is `.resilient`)
Additional Fields	`collection`	No	`{}`	Optional properties to set on the new case.
— Description (`description`)	`string`	No	—	Description of the case.
— Owner (`owner`)	`string`	No	—	Valid application owner registered within the Cases RBAC system. Defaults to securitySolution.
— Sync Alerts (`syncAlerts`)	`boolean`	No	`false`	Whether to synchronize with alerts.

Case: Delete

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to delete.

Case: Get

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to retrieve.

Case: Get Many

Parameter	Type	Required	Default	Description
Return All	`boolean`	No	`false`	Whether to return all results or only up to a given limit.
Limit	`number`	No	`50`	Max number of results to return. (shown when Return All is `false`)
Filters	`collection`	No	`{}`	Narrow the listing. Only the filters you add are sent.
— Status (`status`)	`options`	No	`open`	Filter cases by status.
				Options: `open`, `in-progress`, `closed`
— Tags (`tags`)	`string`	No	—	Comma-separated list of tags to filter by.
— Owner (`owner`)	`string`	No	—	Filter by case owner application.
Sort Options	`collection`	No	`{}`	How to order the listing.
— Sort Field (`sortField`)	`options`	No	`createdAt`	Field to sort results by.
				Options: `createdAt`, `updatedAt`
— Sort Order (`sortOrder`)	`options`	No	`asc`	Sort direction.
				Options: `asc`, `desc`

Case: Update

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to update.
Update Fields	`collection`	No	`{}`	Fields to change. Add at least one — the item fails if this is empty.
— Description (`description`)	`string`	No	—	New description for the case.
— Status (`status`)	`options`	No	`open`	New status for the case.
				Options: `open`, `in-progress`, `closed`
— Sync Alerts (`syncAlerts`)	`boolean`	No	`false`	Whether to synchronize with alerts.
— Title (`title`)	`string`	No	—	New title for the case.

Case Comment: Add

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to add a comment to.
Comment	`string`	Yes	—	Text content of the comment.
Simplify	`boolean`	No	`true`	Whether to return a simplified version of the response instead of the raw data.
Additional Fields	`collection`	No	`{}`	Optional properties to set on the comment.
— Owner (`owner`)	`string`	No	—	Valid application owner registered within the Cases RBAC system.

Case Comment: Get

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case containing the comment.
Comment ID	`string`	Yes	—	ID of the comment to retrieve.

Case Comment: Get Many

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to list comments for.
Return All	`boolean`	No	`false`	Whether to return all results or only up to a given limit.
Limit	`number`	No	`50`	Max number of results to return. (shown when Return All is `false`)

Case Comment: Remove

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case containing the comment to remove.
Comment ID	`string`	Yes	—	ID of the comment to remove.

Case Comment: Update

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case containing the comment.
Comment ID	`string`	Yes	—	ID of the comment to update.
Comment	`string`	Yes	—	Replacement text for the comment.
Simplify	`boolean`	No	`true`	Whether to return a simplified version of the response instead of the raw data.

Case Tag: Add

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to add the tag to.
Tag	`string`	Yes	—	Tag to attach to the case. The item fails if the case already carries this tag.

Case Tag: Remove

Parameter	Type	Required	Default	Description
Case ID	`string`	Yes	—	ID of the case to remove the tag from.
Tag	`string`	Yes	—	Tag to remove from the case. The item fails if the case does not carry this tag.

Connector: Create

Parameter	Type	Required	Default	Description
Connector Name (`name`)	`string`	Yes	—	Display name for the connector.
Connector Type	`options`	Yes	`.jira`	Type of the connector to create.
				Options: `.resilient`, `.jira`, `.servicenow`
API URL	`string`	Yes	—	URL of the third-party instance (Jira, ServiceNow, or IBM Resilient).
Email	`string`	Yes	—	Jira-registered email address. (shown when Connector Type is `.jira`)
API Token	`string`	Yes	—	Jira API token. Stored as a password field. (shown when Connector Type is `.jira`)
Project Key	`string`	Yes	—	Jira project key. (shown when Connector Type is `.jira`)
Username	`string`	Yes	—	ServiceNow ITSM username. (shown when Connector Type is `.servicenow`)
Password	`string`	Yes	—	ServiceNow ITSM password. Stored as a password field. (shown when Connector Type is `.servicenow`)
API Key ID	`string`	Yes	—	IBM Resilient API key ID. Stored as a password field. (shown when Connector Type is `.resilient`)
API Key Secret	`string`	Yes	—	IBM Resilient API key secret. Stored as a password field. (shown when Connector Type is `.resilient`)
Organization ID	`string`	Yes	—	IBM Resilient organization ID. (shown when Connector Type is `.resilient`)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	`number`	No	`5`	Maximum number of items to process concurrently (1–20).

Output Data

Every operation merges the Kibana response onto the input item’s JSON — the fields the item already carried survive, and a response key with the same name overwrites the item’s value. Binary data on the input item is forwarded unchanged.

The number of output items follows the shape of the reply: an array reply fans out to one output item per entry, and any other reply produces exactly one output item.

Operation	Output
Case Get Many, Case Comment Get Many	One output item per case or comment. A listing that matches nothing produces no output items at all, so that branch of the workflow simply stops.
Case Get, Case Get Status, Connector Create	One output item carrying the returned object.
Case Create	One output item carrying the created case.
Case Update, Case Tag Add, Case Tag Remove	The Cases API replies with the updated case records; each one becomes an output item.
Case Comment Add, Case Comment Update	With Simplify on (the default), one output item carrying just the comment that was added or changed. With Simplify off, the raw reply is merged instead.
Case Delete, Case Comment Remove	One output item carrying `success: true` — these calls confirm the change instead of returning a record.

Usage Examples

Create a new security case linked to a Jira connector
Get all open security cases filtered by tag
Add a comment to an existing case
Update case status to in-progress or closed
Add or remove tags from a case
Create a Jira or ServiceNow connector for case syncing

Example Configuration

Open a case that syncs to Jira:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Security Incident - Suspicious Activity",
    "connectorId": "jira-connector-123",
    "connectorType": ".jira",
    "issueType": "Bug",
    "priority": "High",
    "additionalFields": {
      "description": "Detected unusual network activity from an internal system",
      "owner": "securitySolution",
      "syncAlerts": true
    }
  }
}

Open a case that syncs to ServiceNow ITSM:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Data Breach Investigation",
    "connectorId": "servicenow-connector-456",
    "connectorType": ".servicenow",
    "urgency": 3,
    "severity": 2,
    "impact": 3,
    "category": "Security",
    "additionalFields": {
      "description": "Potential data breach requiring immediate investigation",
      "syncAlerts": true
    }
  }
}

List the 50 most recent open cases carrying particular tags:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "status": "open",
      "tags": "security,critical"
    },
    "sortOptions": {
      "sortField": "createdAt",
      "sortOrder": "desc"
    }
  }
}

Close a case and stop alert syncing:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "case",
    "operation": "update",
    "caseId": "case-12345",
    "updateFields": {
      "status": "closed",
      "description": "Investigation completed - no security breach found",
      "syncAlerts": false
    }
  }
}

Add an investigation note to a case:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "caseComment",
    "operation": "add",
    "caseId": "case-12345",
    "comment": "Investigation revealed no actual breach. False positive from the monitoring system.",
    "simple": true
  }
}

Tag a case once it has been triaged:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "caseTag",
    "operation": "add",
    "caseId": "case-12345",
    "tag": "investigated"
  }
}

Create a Jira connector:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "connector",
    "operation": "create",
    "name": "Jira Security Connector",
    "connectorType": ".jira",
    "apiUrl": "https://company.atlassian.net",
    "email": "security@company.com",
    "apiToken": "your-jira-api-token",
    "projectKey": "SEC"
  }
}

Create a ServiceNow ITSM connector:

{
  "type": "elastic_security",
  "parameters": {
    "resource": "connector",
    "operation": "create",
    "name": "ServiceNow ITSM Connector",
    "connectorType": ".servicenow",
    "apiUrl": "https://company.service-now.com",
    "username": "elastic_user",
    "password": "your-servicenow-password"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage Elastic Security cases, comments, tags, and connectors via the Kibana API.

Parameter values are sent literally. This node does not evaluate {{ ... }} expressions in its fields, so a case ID must be typed in rather than read from the incoming item.
Connector Type has to match the connector. On Case Create the node looks the connector up first and fails the item when the selected type differs from the connector’s real type, so a case is never opened against the wrong system.
Updates are read-modify-write. Case Update, Case Tag Add and Case Tag Remove each fetch the current record, apply the change and send it back with its version, so two nodes editing the same case at the same time can collide — sequence them rather than running them in parallel.
Tag operations are strict. Adding a tag the case already has, or removing one it does not have, fails that item instead of silently doing nothing.
Turn Simplify off when you need the whole case. On comment Add and Update it is the difference between getting the single comment back and getting the full case record.

Elastic Security

Elastic Security

Overview

Node Type

Input / Output

Credentials

Resources

Operations

Parameters

Case: Create

Case: Delete

Case: Get

Case: Get Many

Case: Update

Case Comment: Add

Case Comment: Get

Case Comment: Get Many

Case Comment: Remove

Case Comment: Update

Case Tag: Add

Case Tag: Remove

Connector: Create

All Operations

Output Data

Usage Examples

Example Configuration

Error Handling

Tips

Frequently asked questions

Build with the Elastic Security node

Elastic Security

Overview

Node Type

Input / Output

Credentials

Resources

Operations

Parameters

Case: Create

Case: Delete

Case: Get

Case: Get Many

Case: Update

Case Comment: Add

Case Comment: Get

Case Comment: Get Many

Case Comment: Remove

Case Comment: Update

Case Tag: Add

Case Tag: Remove

Connector: Create

All Operations

Output Data

Usage Examples

Example Configuration

Error Handling

Tips

Frequently asked questions

Related nodes

Build with the Elastic Security node