Sign in once. Siftree reads your records and reacts to new events as they happen.
Find Assignable Users
List users who have created or reported Elastic Security cases, via GET /api/cases/reporters, to discover valid profile_uid values for the assignees parameter on Create or Update Case . Kibana has no public endpoint…
Find Cases
Find and list Elastic Security cases via GET /api/cases/_find, or fetch a single case directly via GET /api/cases/{caseId} when caseId is provided. Use this to search/browse cases, or to look up one case's full details…
Includes its version token) once you have an ID. Run this first to obtain a caseId before using Create or Update Case, Add Case Comment, or Delete Record . Example: calling with search: "perimeter breach" and status: "open" returns { total: 1, cases: [{ id: "a1c1...", title: "Isla Nublar Perimeter Breach", severity: "high", status: "open", ... }] } ; use fields to shrink each case down to just the fields you need, and more
Find Detection Rules
Find and list Elastic Security detection rules via GET /api/detection_engine/rules/_find, or fetch a single rule directly via GET /api/detection_engine/rules when id or ruleId is provided. Use this to search/browse…
List Tags
List all unique tags currently in use across Elastic Security cases via GET /api/cases/tags, or detection rules via GET /api/detection_engine/tags. Use this before tagging a case or rule so you reuse an existing tag…
Search Alerts
Search Elastic Security detection alerts (signals) via POST /api/detection_engine/signals/search using raw Elasticsearch Query DSL. Use this to find alert IDs before running Update Alert Status , or to investigate…
Act
Take action in Elastic Security
Agents update records and send messages for you, automatically, as drafts, or after you approve.
Add Case Comment
Add a user comment to an Elastic Security case via POST /api/cases/{caseId}/comments. Use this to log investigation notes or updates on a case without changing its status or fields — use Create or Update Case for that.…
Create or Update Case
Create a new Elastic Security case, or update an existing one when caseId is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags,…
Create or Update Detection Rule
Create a new Elastic Security detection rule via POST /api/detection_engine/rules, or full-replace update an existing one when id is provided, via PUT /api/detection_engine/rules. On update, the tool first fetches the…
Delete Record
Permanently delete an Elastic Security case or detection rule by ID. Cases are deleted via DELETE /api/cases; detection rules via DELETE /api/detection_engine/rules. Run Find Cases or Find Detection Rules first to…
Run Detection Rule
Manually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk action run ). Use this to test a rule immediately instead of waiting for its next…
Update Alert Status
Set the workflow status of one or more Elastic Security alerts (signals) by ID via POST /api/detection_engine/signals/status. Run Search Alerts first to obtain signal IDs. Example: calling with alertStatus: "closed" ,…
Siftree is an AI platform that sales, CX, marketing, product, and strategy teams use to find, win, and keep customers.
Siftree connects calls, tickets, reviews, social, documents, video, and the systems you already use — then builds pipelines, datasets, tools, and cited insights your team and agents can operate on. Long-horizon agents keep building after you walk away.
- Describe what you need in plain language; Siftree builds pipelines, structures the data, and routes models for language, vision, audio, transcription, classification, and enrichment.
- Operate on datasets, tools, reports, and cited insights. You define the rules — what counts, how it's scored, what gets labeled.
- Marketplace: 14,824 sources across 4,169 apps and websites as of October 2026, plus any public website. Search, choose a source, and create an analysis-ready dataset without scraper maintenance.
- Native connectors for help desks, CRMs, and call recorders, plus upload and API. Audio and video are transcribed and labeled with everything else.
- Runs on a schedule or a trigger, and alerts your team in Slack when a threshold is crossed.
- Acts in your systems: writes labels and fields back to the help desk or CRM, opens issues in Linear or Jira, and drafts replies and emails. Each agent runs automatically, drafts for review, or asks first, and every action is logged.
- Ask questions of your data from Claude or ChatGPT through Siftree MCP.
- Enterprise protections: continuous verification of every request, encryption in storage and transit, privilege and identity governance, immutable activity logs.
- Teams use the eight products in place of separate point tools for prospecting data, support analytics, social listening, community triage, ad research, AI search visibility, research repositories, and competitive intelligence.