Security action steps

Security action steps (security.*) provide named, schema-validated operations for Elastic Security. Use these instead of a generic kibana.request call when a named step exists for the task.

These steps are authenticated automatically using the permissions or API key of the identity executing the workflow, the same model as the kibana.* and cases.* steps.

Alert triage steps manage the alert lifecycle: status, assignees, and tags on individual alerts.

Use them to:

  • Set alert status and manage alert tags and assignees (security.setAlertStatus, security.setAlertTags, security.assignAlert)

Refer to Alert triage action steps for shared conventions, parameters, and YAML examples.

Attack triage steps manage the attack lifecycle you work with on the Attacks page: status, assignees, and tags on the correlated attacks that group related alerts.

Use them to:

  • Set attack status and manage attack tags and assignees (security.setAttackStatus, security.setAttackTags, security.assignAttack)

Refer to Attack triage action steps for shared conventions, parameters, and YAML examples.

Detection rules steps enable or disable detection rules by ID list or KQL query, with partial-failure reporting in the step output.

Use them to:

  • Enable one or more detection rules (security.enableRule)
  • Disable one or more detection rules (security.disableRule)

Refer to Detection rules action steps for shared conventions, parameters, output fields, and YAML examples.

Exception steps add exception items so that matching events stop generating alerts, either on one rule or on a shared exception list.

Use them to:

  • Add an exception to a rule's own default exception list (security.createRuleException)
  • Add an item to an existing exception list (security.createExceptionListItem)

Refer to Exceptions action steps for shared conventions, parameters, output fields, and YAML examples.