Resources · n8n integration

Elastic Security n8n integrationAutomate Elastic Security with n8n.

Can a workflow open, comment and close an Elastic Security case on its own? It can. The Elastic Security n8n integration ships 14 operations over 4 resources: cases, case comments, case tags and connectors. No trigger node comes with it, so the run starts somewhere else and the node does the writing.

Try the Elastic Security integration on n8nSee the 14 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the Elastic Security n8n integration actually do?

It wires the case management side of Elastic Security into the rest of your tooling. One node, 4 resources, 14 operations: create and update cases, read them back, attach or edit comments, add and remove tags, and register a connector toward Jira, ServiceNow ITSM or IBM Resilient. Nothing here watches for changes on its own, so another node has to start the run.

Start with the reporting angle, because it is the fastest win. Get many cases reads the case list with a Status filter and a sort key, and the items land in a Google Sheets tab or straight into a Slack message. Run it on a Schedule Trigger, the n8n node that fires on a fixed interval, and the weekly triage list writes itself.

The second pattern moves in the other direction. A ticket changes state in your own database, and the workflow answers by posting a comment on the matching case. Read the row with Postgres, map the case identifier into Case ID, and Add a comment to a case leaves the trace where analysts will see it. Same idea with tags: Add a tag to a case marks everything that came from an automated path.

Third, connectors. Create a connector registers the third-party system that Elastic Security cases can be pushed into, and it takes the credentials of that system, not of Elastic. Doing it from a workflow is useful when several deployments need the same connector set up the same way.

When an endpoint sits outside these 14 operations, the HTTP Request node calls it directly and reuses the same credential through predefined authentication. That is the normal route, not a workaround, and it keeps one set of secrets for the whole workflow.

One thing to plan for: pagination. Return All chains the API pages and brings back every case or every comment. Leave it off and the node stops at the number you set in Limit, which is fine for a preview and wrong for an export. If you are still weighing platforms before you build any of this, the n8n review goes through the trade-offs.

Connect

How do you connect Elastic Security to n8n?

  1. 01

    Get the deployment ready

    Two prerequisites before n8n sees anything: an Elastic Security account, and a deployed application. Without a live deployment there is no endpoint to point the credential at, and the node has nowhere to send its calls. If someone else runs the deployment, this is the moment to ask them for access rather than halfway through building the workflow.

  2. 02

    Pick basic auth or an API key

    The credential supports two methods. Basic auth takes a Username and a Password, the same pair you log into Elasticsearch with. The other route is an API Key, created for that same account from the Elasticsearch key documentation. A credential in n8n is a saved set of secrets: you fill it once under Credentials, then every Elastic Security node picks it from a dropdown.

  3. 03

    Copy the Base URL out of the deployment

    Both methods also need the Base URL, the endpoint of your Elasticsearch application. Choose Manage this deployment in Elasticsearch, open the Applications section, copy the Elasticsearch application endpoint, and paste it into the n8n credential. Save, and the node is ready to run against that deployment.

Actions

The 14 operations, one by one

The Elastic Security node exposes 14 operations across 4 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.

Resources × operations matrix
ResourceCreateGetGet ManyUpdateDeleteAddRemoveGet Status
Case✓✓✓✓✓✓
Case Comment✓✓✓✓✓
Case Tag✓✓
Connector✓

Case

6 operations
01

Create a case

case.create

What you see in n8n

Notes & use cases

Opens a new case in Elastic Security and hands the created record to the next node.

Key parameters

  • Title: what analysts read in the case list, so make it specific.
  • Connector Name or ID: pick it from the list, or pass an ID with an expression, the n8n formula written {{ $json.field }}.
  • Connector Type: .jira, .servicenow or .resilient. It decides the rest of the form: Issue Type and Priority for Jira, Urgency, Severity, Impact, Category for ServiceNow ITSM, Issue Types and Severity Code for IBM Resilient.
  • Additional Fields: Description, Owner, Sync Alerts.
Use cases
a nightly run turns each unhandled item from an internal queue into a case with a Jira connector.
02

Delete a case

case.delete

What you see in n8n

Notes & use cases

Deletes the case whose identifier you pass, and only that one. Nothing is returned to reuse afterwards, so put any lookup before this node, never after.

Key parameters

  • Case ID: the identifier of the case to delete. Usually it comes from a previous node as {{ $json.field }} rather than being typed in by hand.
Use cases
cleaning up a staging deployment after a test run, where a workflow created a batch of throwaway cases and the same workflow tears them down at the end.
03

Get a case

case.get

What you see in n8n

Notes & use cases

Reads one case back and pushes its data into the workflow, which is how you check the current state before deciding what to do next.

Key parameters

  • Case ID: the identifier of the case to read. An IF node placed right after this one can branch on what came back.
Use cases
before reopening a case from an external ticket, fetch it first so the workflow updates a case that still exists instead of failing on a stale identifier.
04

Get many cases

case.getAll

What you see in n8n

Notes & use cases

Lists cases and sends them on as separate items, one per case, which makes it the entry point for every reporting or bulk workflow.

Key parameters

  • Return All: on, n8n walks the API pages and brings back every case; off, it stops at Limit.
  • Status in Filters: open, in-progress or closed.
  • Tag Names or IDs: pick tags from the list, or pass IDs with an expression.
  • Sort Key and Sort Order: createdAt or updatedAt, asc or desc.
Use cases
a Monday morning digest of every case still open, sorted by createdAt ascending so the oldest one is at the top of the message.
05

Get the status of a case

case.getStatus

What you see in n8n

Notes & use cases

Retrieves a summary of all case activity instead of a single case. There is nothing to configure: the operation takes no parameters, so drop the node in and run it.

Use cases
a dashboard refresh that calls this once per hour and stores the summary, so the team watches the shape of the caseload over the week rather than counting cases by hand. It also works as a cheap connectivity check when a credential has just been rotated into place: if this returns data, the Base URL and the authentication method are both right.
06

Update a case

case.update

What you see in n8n

Notes & use cases

Edits a case that already exists. Only the fields you add to the collection are touched, the rest of the case stays as it was.

Key parameters

  • Case ID: which case to edit.
  • Update Fields: Title, Description, Status among open, in-progress and closed, Sync Alerts, and Version.
Use cases
an approval posted in Slack flips the case to closed and rewrites the Title with the resolution, so the case list reads like a log.

Case Comment

5 operations
07

Add a comment to a case

caseComment.add

What you see in n8n

Notes & use cases

Posts a comment on a case, which is where automated context belongs: what the workflow found, where it looked, what it did next.

Key parameters

  • Case ID: the case that will hold the comment.
  • Comment: the text itself, often built from earlier nodes.
  • Simplify: on, the node returns a trimmed response instead of the raw payload.
  • Owner in Additional Fields: a valid application owner registered in the Cases role based access control system.
Use cases
enrichment. A lookup runs against an internal asset table and the result is written straight onto the case as a comment.
08

Get a case comment

caseComment.get

What you see in n8n

Notes & use cases

Fetches one specific comment rather than the whole thread, which keeps a workflow small when it already knows which comment it cares about.

Key parameters

  • Case ID: the case containing the comment to retrieve.
  • Comment ID: the comment itself. Both are identifiers, not text you can guess, so they normally arrive from a previous node.
Use cases
re-reading a comment the workflow wrote earlier to confirm the text landed intact before a second workflow acts on it.
09

Get many case comments

caseComment.getAll

What you see in n8n

Notes & use cases

Walks through the comments attached to one case and outputs them as separate items, so the next node can loop over the thread.

Key parameters

  • Case ID: the case whose comments you want. Required here, unlike the case listing, because comments only exist inside a case.
  • Return All: on for the full thread; off, the node stops at Limit.
Use cases
archiving. Before a case is closed, the whole discussion is pulled out and written to a table so the record survives outside the deployment.
10

Remove a comment from a case

caseComment.remove

What you see in n8n

Notes & use cases

Takes one comment off its case. The case itself is untouched, only the comment goes.

Key parameters

  • Case ID: the case containing the comment to remove.
  • Comment ID: which comment to drop.
Use cases
a noisy integration that posted the same automated comment on every run. A cleanup workflow lists the thread, filters what it wrote itself, and removes those entries one by one before the case goes to review.
11

Update a comment from a case

caseComment.update

What you see in n8n

Notes & use cases

Replaces the text of a comment that is already on a case, rather than stacking a correction underneath it.

Key parameters

  • Case ID and Comment ID: which comment to edit.
  • Comment: the text that replaces the current comment message. It overwrites, so build the full new text upstream.
  • Simplify: on for a trimmed response.
Use cases
a long running job posts a placeholder comment when it starts, then edits the same comment with the result when it finishes.

Case Tag

2 operations
12

Add a tag to a case

caseTag.add

What you see in n8n

Notes & use cases

Attaches one tag to a case. Tags are what make the case list filterable later, so this operation pays off in the reporting workflows, not in itself.

Key parameters

  • Case ID: the case to tag.
  • Tag Name or ID: the tag to attach. Choose it from the list, or specify an ID using an expression when the value is computed upstream.
Use cases
every case a workflow creates gets a tag identifying the automation, and Get many cases can then filter on it with Tag Names or IDs.
13

Remove a tag from a case

caseTag.remove

What you see in n8n

Notes & use cases

Pulls a tag back off a case, which is how a workflow retires a label once it no longer describes the case.

Key parameters

  • Case ID: the case to untag.
  • Tag Name or ID: choose from the list, or specify an ID using an expression.
Use cases
a triage flow tags incoming cases as needing review, then drops that tag the moment an analyst updates the case, keeping the review queue honest without anyone maintaining it.

Connector

1 operation
14

Create a connector

connector.create

What you see in n8n

Notes & use cases

Registers the third-party system that Elastic Security cases can be sent into. Connectors cover ServiceNow, Jira and IBM Resilient only.

Key parameters

  • Connector Name and Connector Type: .jira, .servicenow or .resilient.
  • API URL: the URL of the third-party instance.
  • Email, API Token and Project Key: the Jira registered email, its API token and the project key.
  • Username and Password: the ServiceNow ITSM account.
  • API Key ID, API Key Secret and Organization ID: the IBM Resilient side.
Use cases
setting up a second deployment with the same connector definition as the first, from one workflow instead of one form.
Need help

Need help automating Elastic Security with n8n?

A person reads every message.

FAQ

Questions people ask next

01Is the Elastic Security n8n integration free?
Yes, on the n8n side. The Elastic Security node ships with n8n, so there is nothing to install and nothing extra to pay for it, whether you run n8n Cloud or a self-hosted instance under the Community Edition and its Sustainable Use license. A workflow behaves the same way in both cases, which means you can build on a local instance and move it later. What your Elastic deployment itself costs is a separate question and this page does not cover it. Budget for the deployment, not for the connector.
02What credentials do you need to connect Elastic Security to n8n?
Two methods are supported: basic auth or an API key. Basic auth takes the Username and Password of the account you log into Elasticsearch with. The API key route takes an API Key created for that same account. Either way you also need the Base URL, the endpoint of your Elasticsearch application, which you copy from Manage this deployment, in the Applications section. Both prerequisites come first: an Elastic Security account, and a deployed application. You create that credential once under Credentials in n8n, then every Elastic Security node in every workflow picks it from a dropdown.
03What are the limits of the Elastic Security node in n8n?
The one that bites first is pagination. On the listing operations, Return All chains the API pages and brings back everything, while leaving it off caps the output at the number set in Limit. Pick deliberately: a preview and an export are not the same job. Beyond that, the node exposes 14 operations across 4 resources, and anything that sits outside them is reached with the HTTP Request node, which calls any endpoint of the API and reuses the same credential through predefined authentication. That fallback is part of the normal design, not a hack around it.
04Is there an Elastic Security trigger in n8n?
No. This tool has no trigger node, so a workflow about it starts with something else. Three options in practice. A Schedule Trigger runs the workflow on a fixed interval, which suits listing and reporting jobs. An n8n Webhook, meaning a URL that n8n exposes and a third-party service calls, lets another system start the run. Or the trigger of another tool in your setup kicks things off, and the Elastic Security node comes next in the chain. Pick based on who owns the event you actually want to react to.
05n8n or Make for Elastic Security?
It depends on four things, and price is only one of them. Hosting: n8n runs self-hosted with Docker or npm, or on n8n Cloud; Make is hosted only. Data control follows from that, since a self-hosted instance keeps the case data and the credentials on infrastructure you own. Cost model: Make bills per operation, which is worth modelling if a workflow lists hundreds of cases on a schedule. Visual logic is the fourth, and it is largely a matter of taste. Both build the same workflow, so decide on hosting first and the rest tends to follow.
Hack'celeration Lab

Get our weekly integration tips.

No spam. Unsubscribe anytime.

Same platform

Other docs you might need on this stack.

Browse all integrations