Integration

Elastic Security integration

Elastic Security detection and response API, served by Kibana: create, read, update and search detection rules, query the alerts those rules raise and change their status, manage exception lists and their items to suppress known-good activity, open and update cases, and isolate or release an endpoint agent. Kibana is self hosted or Elastic Cloud hosted, so the Kibana host is part of the credential alongside the API key.

Connect Elastic Security How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Elastic Security.Built from the 18 Elastic Security tools below, on the connection you add once.

Common Elastic Security use cases

listing open cases assigned to an analyst
tuning a noisy rule by narrowing its query
pulling open critical alerts into a triage workflow
auditing which detection rules are currently disabled
deploying a detection rule from a rule as code pipeline
reading a rule's query before proposing a tuning change
opening a case automatically when a critical alert fires
restoring a host to the network once it has been cleaned
checking whether a case is still open before adding to it
closing alerts in bulk once automated triage cleared them

What you can do with Elastic Security

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Rule, 6 operations

bulk_rule_actionBulk rule actionPOSTEnables, disables, deletes, duplicates, exports or edits many detection rules in one call.
create_ruleCreate rulePOSTCreates an Elastic Security detection rule that raises alerts when its query matches.
delete_ruleDelete ruleDELETEDeletes an Elastic Security detection rule.
find_rulesFind rulesGETSearches Elastic Security detection rules by name, tag or enabled state.
get_ruleGet ruleGETReturns a single Elastic Security detection rule with its query, schedule and risk scoring.
update_ruleUpdate rulePUTReplaces an Elastic Security detection rule with the definition you supply.

Case, 3 operations

create_caseCreate casePOSTOpens an Elastic case to track an investigation.
find_casesFind casesGETSearches Elastic cases by status, severity, tag, assignee or time range.
get_caseGet caseGETReturns a single Elastic case with its status, severity and attached comments.

Alert, 2 operations

search_alertsSearch alertsPOSTSearches the alerts raised by Elastic Security detection rules using an Elasticsearch query.
set_alert_statusSet alert statusPOSTMarks Elastic Security alerts as open, acknowledged, in-progress or closed.

Endpoint, 2 operations

isolate_endpointIsolate endpointPOSTCuts a host off the network while leaving the Elastic agent reachable.
release_endpointRelease endpointPOSTRestores network access to hosts that were previously isolated.

Exception item, 2 operations

create_exception_list_itemCreate exception list itemPOSTAdds a condition to an Elastic Security exception list so matching activity stops raising alerts.
find_exception_list_itemsFind exception list itemsGETSearches the items held in Elastic Security exception lists.

Exception list, 2 operations

create_exception_listCreate exception listPOSTCreates an Elastic Security exception list that rules can use to suppress known-good activity.
find_exception_listsFind exception listsGETSearches the Elastic Security exception lists defined in a space.

Comment, 1 operation

add_case_commentAdd case commentPOSTPosts a comment on an Elastic case or attaches a detection alert to it.

Use Elastic Security from Claude Code, Cursor or Codex

Connect Elastic Security in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Elastic Security operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Elastic Security

Create your workspace
Sign up free. Nothing to install.
Connect Elastic Security once
Add your Elastic Security connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Elastic Security integration FAQ

What can you do with the Elastic Security integration?

LiveContext exposes 18 operations on Elastic Security, covering rule, case, alert and endpoint. Common uses include listing open cases assigned to an analyst, tuning a noisy rule by narrowing its query and pulling open critical alerts into a triage workflow.