---
title: Step type index
description: Every step type available for Elastic Workflows, ordered alphabetically, with a one-line description and a link to its full reference.
url: https://www.elastic.co/docs/explore-analyze/workflows/reference/step-types
products:
- Elastic Cloud Enterprise
- Elastic Cloud Hosted
- Elastic Cloud Serverless
- Elastic Cloud on Kubernetes
- Elastic Documentation
- Elastic Stack
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available since 9.4, Preview in 9.3
---
# Step type index
Every step type available for Elastic Workflows, ordered alphabetically. Use this lookup when you know the step ID and want the reference fast. If you know what you want to *do* but not which step to use, refer to [Choose the right step](https://www.elastic.co/docs/explore-analyze/workflows/authoring-techniques/choose-the-right-step).
| Step type | Category | What it does |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|---------------------------------------------------------------------------------------------------|
| [`ai.agent`](/docs/explore-analyze/workflows/steps/ai-steps#ai-agent) | AI | Invoke an Elastic Agent Builder agent as a step. |
| [`ai.attachment.add`](/docs/explore-analyze/workflows/steps/ai-steps#ai-attachment-add) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Add an attachment to an Elastic Agent Builder conversation. |
| [`ai.attachment.delete`](/docs/explore-analyze/workflows/steps/ai-steps#ai-attachment-delete) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Delete an attachment from an Elastic Agent Builder conversation. |
| [`ai.attachment.list`](/docs/explore-analyze/workflows/steps/ai-steps#ai-attachment-list) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | List the attachments in an Elastic Agent Builder conversation. |
| [`ai.attachment.read`](/docs/explore-analyze/workflows/steps/ai-steps#ai-attachment-read) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Read the content of an attachment in an Elastic Agent Builder conversation. |
| [`ai.attachment.update`](/docs/explore-analyze/workflows/steps/ai-steps#ai-attachment-update) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Update an attachment in an Elastic Agent Builder conversation. |
| [`ai.classify`](/docs/explore-analyze/workflows/steps/ai-steps#ai-classify) | AI | Classify input into a fixed category set. |
| [`ai.conversation.metadata.patch`](/docs/explore-analyze/workflows/steps/ai-steps#ai-conversation-metadata-patch) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Update the metadata of an Elastic Agent Builder conversation. |
| [`ai.conversation.metadata.read`](/docs/explore-analyze/workflows/steps/ai-steps#ai-conversation-metadata-read) Elastic Stack: Planned Elastic Cloud Serverless: Generally available | AI | Read the metadata of an Elastic Agent Builder conversation. |
| [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) | AI | Prompt a model, optionally with structured output. |
| [`ai.summarize`](/docs/explore-analyze/workflows/steps/ai-steps#ai-summarize) | AI | Summarize content with an LLM. |
| [`cases.addAlerts`](/docs/explore-analyze/workflows/steps/cases#cases-addalerts) | Cases | Attach detection alerts to a case. |
| [`cases.addAttachments`](/docs/explore-analyze/workflows/steps/cases#cases-addattachments) Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available | Cases | Attach several attachment types to a case in one request. |
| [`cases.addComment`](/docs/explore-analyze/workflows/steps/cases#cases-addcomment) | Cases | Add a comment to a case. |
| [`cases.addEvents`](/docs/explore-analyze/workflows/steps/cases#cases-addevents) | Cases | Attach events to a case. |
| [`cases.addObservables`](/docs/explore-analyze/workflows/steps/cases#cases-addobservables) | Cases | Add observables (IPs, hashes, domains) to a case. |
| [`cases.addTags`](/docs/explore-analyze/workflows/steps/cases#cases-addtags) | Cases | Add tags to a case. |
| [`cases.assignCase`](/docs/explore-analyze/workflows/steps/cases#cases-assigncase) | Cases | Assign a case to one or more users. |
| [`cases.closeCase`](/docs/explore-analyze/workflows/steps/cases#cases-closecase) | Cases | Close a case. |
| [`cases.createCase`](/docs/explore-analyze/workflows/steps/cases#cases-createcase) | Cases | Create a case. |
| [`cases.createCaseFromTemplate`](/docs/explore-analyze/workflows/steps/cases#cases-createcasefromtemplate) | Cases | Create a case from a template. |
| [`cases.deleteCases`](/docs/explore-analyze/workflows/steps/cases#cases-deletecases) | Cases | Delete one or more cases. |
| [`cases.deleteObservable`](/docs/explore-analyze/workflows/steps/cases#cases-deleteobservable) | Cases | Delete an observable from a case. |
| [`cases.findCases`](/docs/explore-analyze/workflows/steps/cases#cases-findcases) | Cases | Search for cases. |
| [`cases.findSimilarCases`](/docs/explore-analyze/workflows/steps/cases#cases-findsimilarcases) | Cases | Find cases similar to a given case. |
| [`cases.getAllAttachments`](/docs/explore-analyze/workflows/steps/cases#cases-getallattachments) | Cases | List every attachment on a case. |
| [`cases.getCase`](/docs/explore-analyze/workflows/steps/cases#cases-getcase) | Cases | Fetch a case by ID. |
| [`cases.getCases`](/docs/explore-analyze/workflows/steps/cases#cases-getcases) | Cases | Fetch multiple cases by ID. |
| [`cases.getCasesByAlertId`](/docs/explore-analyze/workflows/steps/cases#cases-getcasesbyalertid) | Cases | Find cases containing a specific alert. |
| [`cases.pushCases`](/docs/explore-analyze/workflows/steps/cases#cases-pushcases) | Cases | Push one or more cases to their configured external connector. |
| [`cases.removeTags`](/docs/explore-analyze/workflows/steps/cases#cases-removetags) | Cases | Remove tags from a case. |
| [`cases.setCategory`](/docs/explore-analyze/workflows/steps/cases#cases-setcategory) | Cases | Set a case's category. |
| [`cases.setCustomField`](/docs/explore-analyze/workflows/steps/cases#cases-setcustomfield) | Cases | Set a custom field on a case. |
| [`cases.setDescription`](/docs/explore-analyze/workflows/steps/cases#cases-setdescription) | Cases | Update a case's description. |
| [`cases.setSeverity`](/docs/explore-analyze/workflows/steps/cases#cases-setseverity) | Cases | Set a case's severity. |
| [`cases.setStatus`](/docs/explore-analyze/workflows/steps/cases#cases-setstatus) | Cases | Set a case's status. |
| [`cases.setTitle`](/docs/explore-analyze/workflows/steps/cases#cases-settitle) | Cases | Update a case's title. |
| [`cases.unassignCase`](/docs/explore-analyze/workflows/steps/cases#cases-unassigncase) | Cases | Remove assignees from a case. |
| [`cases.updateCase`](/docs/explore-analyze/workflows/steps/cases#cases-updatecase) | Cases | Update one case's fields. |
| [`cases.updateCases`](/docs/explore-analyze/workflows/steps/cases#cases-updatecases) | Cases | Bulk update multiple cases. |
| [`cases.updateObservable`](/docs/explore-analyze/workflows/steps/cases#cases-updateobservable) | Cases | Update an observable. |
| [`console`](https://www.elastic.co/docs/explore-analyze/workflows/steps/external-systems-apps) | HTTP and console | Log a message to the workflow execution view. |
| [`data.aggregate`](/docs/explore-analyze/workflows/steps/data#data-aggregate) | Data | Group and aggregate a collection. |
| [`data.concat`](/docs/explore-analyze/workflows/steps/data#data-concat) | Data | Concatenate arrays. |
| [`data.dedupe`](/docs/explore-analyze/workflows/steps/data#data-dedupe) | Data | Remove duplicates from an array. |
| [`data.filter`](/docs/explore-analyze/workflows/steps/data#data-filter) | Data | Keep elements matching a KQL predicate. |
| [`data.find`](/docs/explore-analyze/workflows/steps/data#data-find) | Data | Return the first element matching a KQL predicate. |
| [`data.map`](/docs/explore-analyze/workflows/steps/data#data-map) | Data | Transform each element of an array. |
| [`data.parseJson`](/docs/explore-analyze/workflows/steps/data#data-parsejson) | Data | Parse a JSON string into an object. |
| [`data.regexExtract`](/docs/explore-analyze/workflows/steps/data#data-regexextract) | Data | Extract fields from a string using regex. |
| [`data.regexReplace`](/docs/explore-analyze/workflows/steps/data#data-regexreplace) | Data | Replace regex matches in a string. |
| [`data.set`](/docs/explore-analyze/workflows/steps/data#data-set) | Data | Set named variables in the workflow context. |
| [`data.stringifyJson`](/docs/explore-analyze/workflows/steps/data#data-stringifyjson) | Data | Serialize an object to a JSON string. |
| [`elasticsearch.bulk`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Bulk index, update, or delete documents. |
| [`elasticsearch.esql.query`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Run an ES|QL query. |
| [`elasticsearch.index`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Index one document. |
| [`elasticsearch.indices.create`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Create an index. |
| [`elasticsearch.indices.delete`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Delete one or more indices. |
| [`elasticsearch.indices.exists`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Check whether indices exist. |
| [`elasticsearch.request`](/docs/explore-analyze/workflows/steps/elasticsearch#generic-request-actions) | Elasticsearch | Generic Elasticsearch API escape hatch. |
| [`elasticsearch.search`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Run a search. |
| [`elasticsearch.update`](/docs/explore-analyze/workflows/steps/elasticsearch#named-actions) | Elasticsearch | Update one document. |
| [`entityStore.updateAssetCriticality`](/docs/explore-analyze/workflows/steps/entity-store#entitystore-updateassetcriticality) Elastic Stack: Preview since 9.5 Elastic Cloud Serverless: Preview | Entity store | Set or remove an entity's asset criticality, and optionally recalculate its risk score. |
| [`foreach`](https://www.elastic.co/docs/explore-analyze/workflows/steps/foreach) | Flow control | Iterate over a collection. |
| [`http`](/docs/explore-analyze/workflows/steps/external-systems-apps#http-actions) | HTTP and console | Call any external HTTP API. |
| [`if`](https://www.elastic.co/docs/explore-analyze/workflows/steps/if) | Flow control | Conditional branching. |
| [`kibana.request`](/docs/explore-analyze/workflows/steps/kibana#kibana-request) | Kibana | Generic Kibana API escape hatch. |
| [`kibana.SetAlertsStatus`](/docs/explore-analyze/workflows/steps/kibana#kibana-setalertsstatus) | Kibana | Update detection alert status. PascalCase. |
| [`kibana.SetAlertTags`](/docs/explore-analyze/workflows/steps/kibana#kibana-setalerttags) | Kibana | Add or remove tags on detection alerts. PascalCase. |
| [`kibana.streams.get`](/docs/explore-analyze/workflows/steps/streams#kibana-streams-get) | Streams (tech preview) | Fetch a stream by name. |
| [`kibana.streams.getSignificantEvents`](/docs/explore-analyze/workflows/steps/streams#kibana-streams-getsignificantevents) | Streams (tech preview) | Get significant events for a stream. |
| [`kibana.streams.list`](/docs/explore-analyze/workflows/steps/streams#kibana-streams-list) | Streams (tech preview) | List available streams. |
| [`loop.break`](https://www.elastic.co/docs/explore-analyze/workflows/steps/loop-break) | Flow control | Exit the innermost loop. |
| [`loop.continue`](https://www.elastic.co/docs/explore-analyze/workflows/steps/loop-continue) | Flow control | Skip to the next iteration. |
| [`parallel`](https://www.elastic.co/docs/explore-analyze/workflows/steps/parallel) Elastic Stack: Preview since 9.5 Elastic Cloud Serverless: Preview | Flow control | Run branches concurrently and collect a per-branch result. |
| [`security.assignAlert`](/docs/explore-analyze/workflows/steps/alert-triage#security-assignalert) | Security | Assign or unassign users on one or more alerts. |
| [`security.assignAttack`](/docs/explore-analyze/workflows/steps/attack-triage#security-assignattack) | Security | Assign or unassign users on one or more attacks. |
| [`security.disableRule`](/docs/explore-analyze/workflows/steps/detection-rules#security-disablerule) Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available | Security | Disable one or more detection rules by rule-ID list or KQL query, with partial-failure reporting. |
| [`security.enableRule`](/docs/explore-analyze/workflows/steps/detection-rules#security-enablerule) Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available | Security | Enable one or more detection rules by rule-ID list or KQL query, with partial-failure reporting. |
| [`security.setAlertStatus`](/docs/explore-analyze/workflows/steps/alert-triage#security-setalertstatus) | Security | Set alert status: `open`, `acknowledged`, or `closed`. |
| [`security.setAlertTags`](/docs/explore-analyze/workflows/steps/alert-triage#security-setalerttags) | Security | Add or remove tags on one or more alerts. |
| [`security.setAttackStatus`](/docs/explore-analyze/workflows/steps/attack-triage#security-setattackstatus) | Security | Set attack status: `open`, `acknowledged`, or `closed`. |
| [`security.setAttackTags`](/docs/explore-analyze/workflows/steps/attack-triage#security-setattacktags) | Security | Add or remove tags on one or more attacks. |
| [`switch`](https://www.elastic.co/docs/explore-analyze/workflows/steps/switch) | Flow control | Multi-way dispatch. |
| [`wait`](https://www.elastic.co/docs/explore-analyze/workflows/steps/wait) | Flow control | Pause for a fixed duration. |
| [`waitForApproval`](https://www.elastic.co/docs/explore-analyze/workflows/steps/wait-for-approval) Elastic Stack: Preview since 9.5 Elastic Cloud Serverless: Preview | Flow control | Pause for approve/reject (human-in-the-loop). |
| [`waitForInput`](https://www.elastic.co/docs/explore-analyze/workflows/steps/wait-for-input) | Flow control | Pause for human input (human-in-the-loop). |
| [`while`](https://www.elastic.co/docs/explore-analyze/workflows/steps/while) | Flow control | Loop while a condition holds. |
| [`workflow.execute`](/docs/explore-analyze/workflows/steps/composition#workflow-execute) | Composition (tech preview) | Run a child workflow synchronously. |
| [`workflow.executeAsync`](/docs/explore-analyze/workflows/steps/composition#workflow-executeasync) | Composition (tech preview) | Fire-and-forget child workflow. |
| [`workflow.fail`](/docs/explore-analyze/workflows/steps/composition#workflow-fail) | Composition (tech preview) | Terminate the workflow as failed. |
| [`workflow.output`](/docs/explore-analyze/workflows/steps/composition#workflow-output) | Composition (tech preview) | Emit the final outputs of a workflow. |
## External connector steps
In addition to the steps listed previously, every configured Kibana connector exposes one or more `.` step types. Common examples include:
- `slack.postMessage` — Post a message to a Slack channel.
- `jira.createIssue` — Create a Jira issue.
- `pagerduty.triggerIncident` — Page an on-call rotation.
- `virustotal.scanFileHash` — Scan a file hash.
Because the available connector steps depend on which connectors your deployment has configured, they aren't enumerated here. Refer to the [Kibana connectors reference](https://docs-edge.elastic.dev/docs/reference/kibana/connectors-kibana) for the full catalog.
## Deprecated step types
Deprecated step types still work in existing workflows but can't be used in new ones. They're hidden from autocomplete and the **Add Action** menu, and the YAML editor shows a deprecation warning with a replacement suggestion on hover.
Refer to the [migration guide](https://www.elastic.co/docs/explore-analyze/workflows/authoring-techniques/migrate-from-9-3) for Cases replacement details. For AI connector steps, replace them with [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) (or another [AI step](https://www.elastic.co/docs/explore-analyze/workflows/steps/ai-steps) such as `ai.classify`, `ai.summarize`, or `ai.agent` when that better matches the task).
| Deprecated | Replacement |
|-------------------------------------|------------------------------------------------------------------------------------|
| `kibana.createCaseDefaultSpace` | [`cases.createCase`](/docs/explore-analyze/workflows/steps/cases#cases-createcase) |
| `kibana.getCaseDefaultSpace` | [`cases.getCase`](/docs/explore-analyze/workflows/steps/cases#cases-getcase) |
| `kibana.updateCaseDefaultSpace` | [`cases.updateCase`](/docs/explore-analyze/workflows/steps/cases#cases-updatecase) |
| `kibana.addCaseCommentDefaultSpace` | [`cases.addComment`](/docs/explore-analyze/workflows/steps/cases#cases-addcomment) |
| `inference.*` | [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) |
| `bedrock.*` | [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) |
| `gen-ai.*` | [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) |
| `gemini.*` | [`ai.prompt`](/docs/explore-analyze/workflows/steps/ai-steps#ai-prompt) |
## Related
- [Steps overview](https://www.elastic.co/docs/explore-analyze/workflows/steps): Common fields every step accepts.
- [Cheat sheet](https://www.elastic.co/docs/explore-analyze/workflows/reference/cheat-sheet): Step menu organized by intent rather than alphabetically.
- [`elastic/workflows` library](https://github.com/elastic/workflows): 57 example workflows that exercise these step types.