App

Elastic Security integrations

Connect Elastic Security to any other app, or use it from your AI client over MCP. SIEM and XDR platform for detecting, investigating, and automating response to security threats across endpoints and logs.

Connects with an API keyelastic.co
10 actions

What the catalog holds today. Ask for anything missing and your agent reads the API documentation and adds it.

Build solutions, not workarounds.

What do you want to automate with Elastic Security?

Ask the assistant

You'll sign in before anything runs. What you typed comes with you.

Connect your AI client

Give your AI client this address.

https://mcp.apiant.ai

One connection does both: ask your client to act in an app once, or have it build an automation that keeps running. Any client that takes a remote MCP server. Nothing to install. Create your free account, then sign in once in your browser.

Set it up in your client
Claude Code

Run this in the directory you want to work in.

claude mcp add --transport http -s project apiant-ai https://mcp.apiant.ai

Start Claude Code there, approve the server, and sign in in the browser page it opens.

Claude Code guide (opens in a new tab)
Claude, web and desktop

Open Customize, then Connectors, then Add custom connector, and paste the address. On Team and Enterprise an owner adds it first.

Setup guide (opens in a new tab)
Cursor

Add the address to your MCP configuration as a server URL. Cursor signs you in in your browser.

Setup guide (opens in a new tab)
Zed

Open Settings, then AI, then MCP Servers, then Add Server, then Add Remote Server.

Setup guide (opens in a new tab)
Codex and the ChatGPT desktop app

Open Settings, then MCP servers, then Add server, and choose Streamable HTTP. From the terminal, Codex takes the address with its own add command and then signs you in.

Setup guide (opens in a new tab)
Any other MCP client

Paste the address where the client asks for a remote MCP server URL, and name the server apiant-ai where it lets you. APIANT's skills reach the client over the same connection.

Setup guide (opens in a new tab)

Popular

Elastic Security with the apps people pair it with most

Pair it

Connect Elastic Security with another app

What your agent can do with Elastic Security

Triggers and actions 10 actions

  • Action
    Add case comment

    Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

  • Action
    Add detection rule

    Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

  • Action
    Add exception list item

    Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

  • Action
    Delete detection rule

    Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

  • Action
    Find cases

    Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

  • Action
    Find detection rules

    Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

  • Action
    Get detection rule

    Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

  • Action
    Get exception list item

    Returns one exception list item, looked up by its id or its human-readable item ID.

  • Action
    Update case

    Updates an existing case's title, description, status, severity, tags, assignees and other fields.

  • Action
    Update detection rule

    Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

Reviews

What our customers say

Questions

Elastic Security, answered

Is there a Elastic Security MCP server?

APIANT's MCP server at https://mcp.apiant.ai works with Elastic Security. Add that address to any AI client that takes a remote MCP server and sign in once in your browser. Your client can then run Elastic Security actions on demand, or have APIANT build, test and run automations that use Elastic Security. Nothing to install.

What can your agent do in Elastic Security?

Any of Elastic Security's 10 actions, including Update case, Update detection rule, Add case comment and Add detection rule. Your agent maps the data both ways and tests every scenario before it ships.

Can I use Elastic Security directly from Claude, ChatGPT or Cursor?

Yes. Connect your AI client to APIANT once and it works with Elastic Security two ways. Ask it to do something in Elastic Security once and it runs that action on the spot. Ask for an automation and your agent builds it, tests every scenario and keeps it running on its own. A one-off action uses your plan's tasks the same way an automation step does.

Do I need to write code against the Elastic Security API?

No. APIANT connects to the Elastic Security API for you, with your Elastic Security API key. Describe what you want in plain language and your agent builds it on the Elastic Security triggers and actions in the catalog. If you need an endpoint that is not there yet, your agent reads the Elastic Security API documentation and adds it.

Which apps can Elastic Security connect to?

Any app in the catalog; the list on this page pairs Elastic Security with each of them. If the other app is missing, point your agent at its API documentation and it builds the connector.

What happens when something fails?

Your agent works that out for you. It plans the failure paths along with the happy path, then tests every scenario before it ships.

Is there a free plan?

Yes. Every plan includes the agent, including free, and building from your own AI client spends no assistant credits.