Security action steps
Security action steps (security.*) provide named, schema-validated operations for Elastic Security. Use these instead of a generic kibana.request call when a named step exists for the task.
These steps are authenticated automatically using the permissions or API key of the identity executing the workflow, the same model as the kibana.* and cases.* steps.
Alert triage steps manage the alert lifecycle: status, assignees, and tags on individual alerts.
Use them to:
- Set alert status and manage alert tags and assignees (
security.setAlertStatus,security.setAlertTags,security.assignAlert)
Refer to Alert triage action steps for shared conventions, parameters, and YAML examples.
Attack triage steps manage the attack lifecycle you work with on the Attacks page: status, assignees, and tags on the correlated attacks that group related alerts.
Use them to:
- Set attack status and manage attack tags and assignees (
security.setAttackStatus,security.setAttackTags,security.assignAttack)
Refer to Attack triage action steps for shared conventions, parameters, and YAML examples.
Detection rules steps enable or disable detection rules by ID list or KQL query, with partial-failure reporting in the step output.
Use them to:
- Enable one or more detection rules (
security.enableRule) - Disable one or more detection rules (
security.disableRule)
Refer to Detection rules action steps for shared conventions, parameters, output fields, and YAML examples.
- Alert triage action steps: Status, assignee, and tag management for individual alerts.
- Attack triage action steps: Status, assignee, and tag management for attacks.
- Detection rules action steps: Enable or disable detection rules by ID list or query.
- Kibana action steps: Generic
kibana.requestand older PascalCase alert steps. - Cases action steps: Hand off a triaged alert or attack to a case.
- Step type index: Alphabetical lookup of every step type.