Elastic Security Tool MCP Server - All 14 Operations

This n8n workflow creates a fully functional MCP (Model Context Protocol) server that exposes every Elastic Security Tool operation—totaling 14—to AI agents seamlessly. Import, activate, and copy the webhook URL to connect AI tools instantly, with no setup required. It handles create, read, update, delete for cases, comments, tags, and connectors using native n8n integrations and AI expressions like $fromAI() for dynamic parameters.

The workflow features an MCP Trigger node as the endpoint, routing requests to dedicated tool nodes for each operation: 6 for cases (create/delete/get/status/update/many), 5 for case comments (add/get/many/remove/update), 2 for case tags (add/remove), and 1 for connectors (create). Error handling ensures reliability, and responses follow native Elastic Security formats.

Benefits include massive time savings for security teams automating incident response, case management, and investigations via AI. Use cases: AI-driven threat hunting, automated case triage, compliance reporting, and integrating security ops with LLMs like Claude or GPT. Perfect for SOC analysts, reducing manual API calls and enabling agentic workflows.

Join the Beyond Nodes community for support, more workflows, and live Q&A.