Cases in Kibana

Cases are used to open and track issues directly in Kibana. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can create cases automatically when alerts occur or send cases to external incident management systems by configuring connectors.

You can also optionally add custom fields and case templates.

Cases are automatically assigned human-readable numeric IDs, which you can use for easier referencing. Each time you create a new case in your space, the case ID increments by one. IDs are assigned to cases by a background task that runs every 10 minutes, which can cause a delay in ID assignment, especially in spaces with many cases. You can find the case ID after the case's name and can use it while searching the Cases table.

×

• Configure access to cases
• Open and manage cases
• Configure case settings
• Use cases as data

• If you create cases in Stack Management, they are not visible from Observability or the Elastic Security app. Likewise, the cases you create in Observability are not visible in Stack Management or Elastic Security.
• You cannot attach alerts from Observability or Elastic Security to cases in Stack Management.