---
title: "Elastic Security"
description: "Reference for the Tracecat Elastic Security integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## List detection alerts

Action ID: `tools.elastic_security.list_detection_signals`

Query for Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts](https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts)

### Secrets

Required secrets:

- `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="base_url" type="string | null">

Kibana endpoint URL (e.g. https://localhost:5601).

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of alerts to return.

Default: `100`.

</ParamField>

<ParamField path="query" type="string | object | null">

Elastic JSON query DSL. If specified, overrides `start_time` and `end_time`.

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>
