.DkNUKaKx_ZLAT4m.webp?dpl=dpl_Crv6NFYc4gRVqEEsmHdUK26mPGZB){kind=small}
Connectors / Security and compliance · HTTP Connector
Automate Elastic Security with Tray.ai
Create a detection rule, create an exception list and create a case in Elastic Security.
Thanks — someone from our team will be in touch soon.
What can you do with Elastic Security on Tray.ai?
Elastic Security is Elastic's security product for threat detection and response, combining SIEM detection rules, alert triage, endpoint protection, and case management. Tray.ai connects to Elastic Security through the HTTP Connector, so your workflows can call the Elastic Security API alongside the rest of your stack.
- Create a case when your ticketing system logs a security incident reported by staff.
- Isolate an endpoint when your identity provider reports a compromised account on that device.
- Find detection alerts every few minutes and page the on-call engineer for critical ones.
- Add a comment to a case when your ticketing system records progress on the linked incident.
- Connects through
- HTTP Connector
- Authentication
- An API key in a request header or basic authentication
Set it up
Connect Elastic Security to Tray.ai
Each step uses Elastic Security's own API details, from its documentation.
Step 1
Save Elastic Security's API key
Save the key as a Tray.ai authentication. The HTTP Client puts it in the request header, read from $.auth. The key stays out of the workflow and out of the logs.
Step 2
Import a request from Elastic Security's docs
Add an HTTP Client step and paste a cURL example from Elastic Security's API docs. Tray.ai fills in the method, URL, headers, and query.
Step 3
Start with “Read a detection rule”
It's one of 16 documented actions, under Detection rules. The response comes back as data the next step can map into your other apps.
Step 4
Hand it to an AI agent
Wrap “Create a detection rule” and “Update a detection rule” in workflows, and Tray.ai's Agent Gateway for MCP publishes them as governed tools Claude and other AI agents can call.
What the Elastic Security API covers
5 resources and 16 documented actions, each one a call the HTTP Connector can make from a Tray.ai workflow. Connecting it takes a few clicks: here's how.
Detection rules
- Create a detection rule
- Read a detection rule
- Update a detection rule
- Delete a detection rule
Detection alerts
- Find detection alerts
- Set alert status
- Set alert assignees
Exception lists
- Create an exception list
- Update an exception list
- Delete an exception list
Cases
- Create a case
- Add a comment to a case
- Push a case externally
Endpoint response actions
- Isolate an endpoint
- Release an endpoint
- Run a scan
Checked against Elastic Security's own documentation on 2026-10-22
How Tray.ai makes this work
Elastic Security plugs into the whole Tray.ai platform
Intelligent Integration
Integrate and automate across 9,000+ apps, databases, APIs, and services with visual workflows, error handling, and observability.
Learn more →Agent Builder
Build AI agents that read, write, and take action in Elastic Security — with guardrails, audit, and human-in-the-loop.
Learn more →Agent Gateway for MCP
Expose Elastic Security actions as governed MCP tools — observable, rate-limited, authenticated.
Learn more →Tray Helix
Build apps on Elastic Security data with your AI assistant, then deploy, run, and govern them on Tray.ai.
Learn more →More security and compliance apps on Tray.ai
Dedicated connectors and other apps Tray.ai reaches in the same category. See every security and compliance connector →
Frequently asked questions
What can a Tray.ai workflow do in Elastic Security?
+
The Elastic Security API documents 16 actions across 5 resources (Detection rules, Detection alerts, Exception lists, Cases, Endpoint response actions). For example: Create a detection rule; Find detection alerts; Create an exception list. A workflow can make any documented call through the HTTP Connector.
How does Tray.ai authenticate with Elastic Security?
+
The Elastic Security API uses an API key in a request header and basic authentication. You save it once as a Tray.ai authentication, and the HTTP Connector adds it to every request.
See Elastic Security working against your stack.
We'll walk through a tailored demo with your systems plugged in.
Thanks — someone from our team will be in touch soon.