# Elastic Security AI employee Viktor works in Elastic Security for you. Ask in Slack or Microsoft Teams. Viktor is an AI employee that connects to Elastic Security and helps you screen for fraud, malware, and security threats, running 11 Elastic Security actions for you like List Tags, Find Cases, and Delete Record. Ask in plain English from your workspace; Viktor does the work in Elastic Security and reports back. Viktor connects with a scoped API key. - Tool: Elastic Security - Category: HR & Recruiting - Connection: API key - Actions available: 11 - Currently available in: Slack, Microsoft Teams, and Discord - Page: https://viktor.com/integrations/elastic-security ## What can your AI employee do in Elastic Security? Viktor connects to your Elastic Security account and completes work in it. He doesn't just answer questions about Elastic Security, he takes the actions on your behalf and delivers the finished result to your workspace. Unlike workflow builders such as Zapier or Make, there is nothing to configure - no triggers to map, no workflows to maintain. You describe the outcome in plain English, and Viktor picks the right Elastic Security actions, chains them with the other 9,800+ tools he connects to, and asks for approval before anything sensitive runs. ### About Elastic Security Detect, investigate, and respond to threats with an all-in-one solution that unifies SIEM, XDR, and cloud security, all powered by AI. ### How a run works 1. **You ask in your workspace** - Describe what you need in plain English 2. **Viktor picks the actions** - Selects from 11 Elastic Security actions, chains them together 3. **Runs in Elastic Security** - Helps you screen for fraud, malware, and security threats - your real data. 4. **Reports back** - Delivers the finished result to your workspace ## Use Elastic Security from Slack and Microsoft Teams Message Viktor in a Slack channel, a Microsoft Teams chat or a direct message. He opens Elastic Security, does the work and posts the result in the same thread, so nobody has to switch tabs. He can also run Elastic Security work on a schedule, like a weekly Elastic Security summary posted to your team's channel. Anything sensitive waits for your approval before it runs. ## Security and permissions - Scoped API keys - Viktor stores your key securely, uses only the scopes you grant, and you can revoke it at any time. - Review-first approvals: sensitive Elastic Security actions wait for your sign-off before they run. - Isolated compute per team, encrypted in transit and at rest - and your data is never used to train models. - SOC 2 Type 1 compliant, with Type 2 and ISO 27001 in progress. ## What can you ask Viktor to do in Elastic Security? - "Check this IP address against Elastic Security and tell me if it's flagged." - "Watch Elastic Security for a new threat matching our domain and alert me right away." - "Run this file through Elastic Security and summarize the scan results." - "Pull this week's flagged signups from Elastic Security and post a summary every Monday." ## How does Viktor work with Elastic Security? 1. Open Viktor in a supported workspace. 2. Connect Elastic Security with an API key - Viktor handles authentication. 3. Ask in plain English. Viktor runs the Elastic Security actions, chains them with your other tools when needed, and reports back. Sensitive actions wait for your approval. ## What can Viktor do in Elastic Security? (11 actions) - **Add Case Comment** - Add a user comment to an Elastic Security case via POST /api/cases/{caseId}/comments. - **Create or Update Case** - Create a new Elastic Security case, or update an existing one when caseId is provided, via POST /api/cases or PATCH /api/cases. - **Create or Update Detection Rule** - Create a new Elastic Security detection rule via POST /api/detectionengine/rules, or full-replace update an existing one when id is provided, via PUT /api/detectionengine/rules. - **Delete Record** - Permanently delete an Elastic Security case or detection rule by ID. - **Find Assignable Users** - List users who have created or reported Elastic Security cases, via GET /api/cases/reporters, to discover valid profileuid values for the assignees parameter on Create or Update Case. - **Find Cases** - Find and list Elastic Security cases via GET /api/cases/find, or fetch a single case directly via GET /api/cases/{caseId} when caseId is provided. - **Find Detection Rules** - Find and list Elastic Security detection rules via GET /api/detectionengine/rules/find, or fetch a single rule directly via GET /api/detectionengine/rules when id or ruleId is provided. - **List Tags** - List all unique tags currently in use across Elastic Security cases via GET /api/cases/tags, or detection rules via GET /api/detectionengine/tags. - **Run Detection Rule** - Manually run one or more Elastic Security detection rules over a time range via POST /api/detectionengine/rules/bulkaction (bulk action run). - **Search Alerts** - Search Elastic Security detection alerts (signals) via POST /api/detectionengine/signals/search using raw Elasticsearch Query DSL. - **Update Alert Status** - Set the workflow status of one or more Elastic Security alerts (signals) by ID via POST /api/detectionengine/signals/status. ## Viktor uses Elastic Security together with - [Slack](https://viktor.com/integrations/slack) - [Gmail](https://viktor.com/integrations/gmail) - [Google Sheets](https://viktor.com/integrations/google-sheets) - [HubSpot](https://viktor.com/integrations/hubspot) - [Notion](https://viktor.com/integrations/notion) - [Salesforce](https://viktor.com/integrations/salesforce) ## More HR & Recruiting integrations - [Moodle](https://viktor.com/integrations/moodle) - [Brainbase Labs](https://viktor.com/integrations/brainbase-labs) - [Deel](https://viktor.com/integrations/deel) - [Lever](https://viktor.com/integrations/lever) - [Buddee](https://viktor.com/integrations/buddee) - [TalentHR](https://viktor.com/integrations/talenthr) - [Clockwork Recruiting](https://viktor.com/integrations/clockwork-recruiting) - [Microsoft Entra ID](https://viktor.com/integrations/microsoft-entra-id) ## FAQ ### Does Viktor integrate with Elastic Security? Yes. Elastic Security is one of the 9,800+ tools Viktor connects to, via a managed connector. Once connected, anyone on your team can put Viktor to work in Elastic Security from their workspace - no workflow builder, no code. ### How do I connect Elastic Security to Viktor? Ask Viktor in your workspace to connect Elastic Security, then paste an API key from your Elastic Security account when prompted. Viktor stores the key securely, uses only the scopes you grant, and you can revoke it at any time. Setup takes about two minutes. ### What can Viktor do in Elastic Security? Viktor can run 11 Elastic Security actions, including List Tags, Find Cases, and Delete Record - and chain them with other tools in a single request. In practice that means Viktor helps you screen for fraud, malware, and security threats. If a task spans several actions, Viktor plans the sequence itself and reports back when the work is done. ### Do I need to build workflows for Elastic Security? No. Viktor isn't a workflow builder - there are no triggers to map and nothing to maintain. You ask for the outcome in plain English in your workspace, and Viktor decides which Elastic Security actions to take, runs them, and reports back. ### Is my Elastic Security data secure with Viktor? Yes. Viktor connects to Elastic Security with a scoped API key, runs in an isolated environment per team, and never trains models on your data. Sensitive actions wait for your approval, and you can revoke access at any time. Viktor is SOC 2 Type 1 compliant, with Type 2 and ISO 27001 in progress. ### How much does the Elastic Security integration cost? Nothing extra - every integration, including Elastic Security, is available on every plan. You can start free with up to $100 in credits, no credit card required; the Team plan is $100 a month. ### Can Viktor use Elastic Security together with my other tools? Yes - that's the point. Viktor connects to 9,800+ tools and works across them in a single run: he can pull data from Elastic Security, cross-reference it with another tool - for example Slack or Gmail, and deliver the finished result in your workspace. ## Get started Viktor is free to start - up to $100 in credits, no credit card required. All 9,800+ integrations are included on every plan. Sign up at https://viktor.com or browse all integrations at https://viktor.com/integrations.