# Elastic Security integrations: detection rules

> Create a detection rule, create an exception list and create a case in Elastic Security.

**Canonical page:** https://tray.ai/connectors/elastic-security-integrations/
**Categories:** Security and compliance
**Connects through:** HTTP Connector

## Overview

Elastic Security is Elastic's security product for threat detection and response, combining SIEM detection rules, alert triage, endpoint protection, and case management. Tray.ai connects to Elastic Security through the HTTP Connector, so your workflows can call the Elastic Security API alongside the rest of your stack.

## Use cases

### Detection rules

Read, create, update, and delete detection rules in Elastic Security from any Tray.ai workflow. The Elastic Security API covers calls such as create a detection rule and read a detection rule.

- Create a detection rule
- Read a detection rule
- Update a detection rule

### Detection alerts

Read and update detection alerts in Elastic Security from any Tray.ai workflow. The Elastic Security API covers calls such as find detection alerts and set alert status.

- Find detection alerts
- Set alert status
- Set alert assignees

### Exception lists

Create, update, and delete exception lists in Elastic Security from any Tray.ai workflow. The Elastic Security API covers calls such as create an exception list and update an exception list.

- Create an exception list
- Update an exception list
- Delete an exception list

### Cases

Create and manage cases in Elastic Security from any Tray.ai workflow. The Elastic Security API covers calls such as create a case and add a comment to a case.

- Create a case
- Add a comment to a case
- Push a case externally

### Endpoint response actions

Create and manage endpoint response actions in Elastic Security from any Tray.ai workflow. The Elastic Security API covers calls such as isolate an endpoint and release an endpoint.

- Isolate an endpoint
- Release an endpoint
- Run a scan

## Challenges Tray.ai solves

### Keeping Elastic Security credentials out of logs

A raw API call usually means pasting a key or token into the request, where it ends up in step inputs, logs, and screenshots.

**How Tray.ai helps:** Store Elastic Security credentials once as a Tray.ai authentication and reference them from the HTTP Connector. Tray.ai masks authentication values in logs, so the secret never shows up in a step's input or output.

### Going from the Elastic Security API docs to a working call

Translating an example request from API docs into a workflow step means copying the method, URL, headers, and body by hand.

**How Tray.ai helps:** Paste a cURL example from the Elastic Security API docs into the HTTP Connector and Tray.ai fills in the method, URL, headers, and body for you.

### Handling files and non-JSON responses

Not every API answers in JSON. Some return XML, files, or binary data, or expect a multipart upload.

**How Tray.ai helps:** The HTTP Connector parses JSON and XML responses, returns files you can pass to the next step, and sends multipart form data for uploads.

## Frequently asked questions

### Does Tray.ai connect to Elastic Security?

Yes. Tray.ai connects to Elastic Security through the HTTP Connector, which calls the Elastic Security API directly. Any call the Elastic Security API documents can run as a step in a Tray.ai workflow.

### How does Tray.ai authenticate with Elastic Security?

The Elastic Security API uses an API key in a request header and basic authentication. You save it once as a Tray.ai authentication, and the HTTP Connector adds it to every request.

### Can I get a dedicated Elastic Security connector?

Elastic Security runs through the HTTP Connector rather than a dedicated connector. If your team wants one, the Tray.ai connector SDK can build a dedicated Elastic Security connector from the Elastic Security API.

## Learn more

- Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/
- Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/
- Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/
- Book a demo: https://tray.ai/contact/