---
title: Security action steps
description: Named security.* workflow action steps for Elastic Security operations such as attack triage and detection rule management.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/security
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# Security action steps
Security action steps (`security.*`) provide named, schema-validated operations for Elastic Security. Use these instead of a generic [`kibana.request`](/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/kibana#kibana-request) call when a named step exists for the task.
These steps are authenticated automatically using the permissions or API key of the identity executing the workflow, the same model as the [`kibana.*`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/kibana) and [`cases.*`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/cases) steps.

## Alert triage

Alert triage steps manage the alert lifecycle: status, assignees, and tags on individual alerts.
Use them to:
- Set alert status and manage alert tags and assignees (`security.setAlertStatus`, `security.setAlertTags`, `security.assignAlert`)

Refer to [Alert triage action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/alert-triage) for shared conventions, parameters, and YAML examples.

## Attack triage

Attack triage steps manage the attack lifecycle you work with on the [Attacks page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page): status, assignees, and tags on the correlated attacks that group related alerts.
Use them to:
- Set attack status and manage attack tags and assignees (`security.setAttackStatus`, `security.setAttackTags`, `security.assignAttack`)

Refer to [Attack triage action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/attack-triage) for shared conventions, parameters, and YAML examples.

## Detection rules

Detection rules steps enable or disable detection rules by ID list or KQL query, with partial-failure reporting in the step output.
Use them to:
- Enable one or more detection rules (`security.enableRule`)
- Disable one or more detection rules (`security.disableRule`)

Refer to [Detection rules action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/detection-rules) for shared conventions, parameters, output fields, and YAML examples.

## Related

- [Alert triage action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/alert-triage): Status, assignee, and tag management for individual alerts.
- [Attack triage action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/attack-triage): Status, assignee, and tag management for attacks.
- [Detection rules action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/detection-rules): Enable or disable detection rules by ID list or query.
- [Kibana action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/kibana): Generic `kibana.request` and older PascalCase alert steps.
- [Cases action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/steps/cases): Hand off a triaged alert or attack to a case.
- [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/workflows/reference/step-types): Alphabetical lookup of every step type.