Security action steps

Security action steps (security.*) provide named, schema-validated operations for Elastic Security. Use these instead of a generic kibana.request call when a named step exists for the task.

These steps are authenticated automatically using the permissions or API key of the identity executing the workflow, the same model as the kibana.* and cases.* steps.

Alert triage steps manage the alert lifecycle: status, assignees, and tags on individual alerts.

Use them to:

• Set alert status and manage alert tags and assignees (security.setAlertStatus, security.setAlertTags, security.assignAlert)

Refer to Alert triage action steps for shared conventions, parameters, and YAML examples.

Attack triage steps manage the attack lifecycle you work with on the Attacks page: status, assignees, and tags on the correlated attacks that group related alerts.

Use them to:

• Set attack status and manage attack tags and assignees (security.setAttackStatus, security.setAttackTags, security.assignAttack)

Refer to Attack triage action steps for shared conventions, parameters, and YAML examples.

Detection rules steps enable or disable detection rules by ID list or KQL query, with partial-failure reporting in the step output.

Use them to:

• Enable one or more detection rules (security.enableRule)
• Disable one or more detection rules (security.disableRule)

Refer to Detection rules action steps for shared conventions, parameters, output fields, and YAML examples.

• Alert triage action steps: Status, assignee, and tag management for individual alerts.
• Attack triage action steps: Status, assignee, and tag management for attacks.
• Detection rules action steps: Enable or disable detection rules by ID list or query.
• Kibana action steps: Generic kibana.request and older PascalCase alert steps.
• Cases action steps: Hand off a triaged alert or attack to a case.
• Step type index: Alphabetical lookup of every step type.