---
title: Action steps
description: Learn about action steps that perform tasks in your workflows.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/action-steps
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Preview in 9.3
---

# Action steps
Action steps are the building blocks that perform tasks in your workflows. They are the operations that do the work, such as searching data, calling an API, managing cases, or interacting with external systems.
Action steps are organized into the following categories.

## Elasticsearch

Elasticsearch actions provide native integration with Elasticsearch APIs. These actions are automatically authenticated and offer a simplified interface for common operations. Use Elasticsearch actions to:
- Search and query data
- Index new documents
- Update or delete existing documents
- Manage indices and data streams

Refer to [Elasticsearch action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/elasticsearch) for more information.

## Kibana

Kibana actions provide native integration with Kibana APIs. Like Elasticsearch actions, they're automatically authenticated. Use Kibana actions to:
- Change detection alert status or tags (`kibana.SetAlertsStatus`, `kibana.SetAlertTags`)
- Call any Kibana API through the `kibana.request` step

Refer to [Kibana action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/kibana) for more information.

## Cases

Cases actions provide 27 step types for creating, querying, updating, and managing the lifecycle of cases in Elastic Security and other Cases-enabled apps. Use Cases actions to:
- Create cases with a full schema or from a template
- Attach alerts, events, observables, and comments
- Assign, tag, categorize, and close cases
- Find cases by criteria or similarity

Refer to [Cases action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/cases) for the complete 27-step catalog.

## Streams

<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Planned
</applies-to>

Streams actions let workflows operate on Observability Streams. Use Streams actions to:
- List available streams
- Fetch a specific stream
- Pull significant events from a stream's time window

Refer to [Streams action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/streams) for more information.

## External systems and apps

External actions let workflows communicate with third-party systems using [connectors](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana). Use external actions to:
- Send notifications to Slack or email
- Create incidents in ServiceNow
- Create issues in Jira
- Call any external API using HTTP requests

Refer to [External systems and apps steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6103/explore-analyze/workflows/steps/external-systems-apps) for more information.