---
title: Configure case settings
description: Configure case closure options, custom fields, templates, and connectors for external incident management systems.
url: https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/cases/configure-case-settings
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Configure case settings
Customize how your team works with cases by setting up templates for faster case creation, adding custom fields to capture data specific to your workflow, and connecting to external systems like Jira or ServiceNow to keep incidents in sync.
To perform these tasks, you must have [full access](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/cases/control-case-access) to the appropriate case and connector features.
<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    To access case settings:
    - **Stack Management**: Go to **Stack Management** > **Cases**, then click **Settings**.
    - **Elastic Security**: Find **Cases** in the navigation menu or search for `Security/Cases` using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects), then click **Settings**.
    - **Observability**: Find **Cases** in the navigation menu or search for `Observability/Cases` using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects), then click **Settings**.
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    To access case settings:
    - **Elastic Security**: Find **Cases** in the navigation menu or search for `Cases` using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects), then click **Settings**.
    - **Observability**: Find **Cases** in the navigation menu or search for `Cases` using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects), then click **Settings**.
  </applies-item>
</applies-switch>


## Close cases automatically

If you close cases in your external incident management system, the cases will remain open in Kibana until you close them manually.
To close cases when they are sent to an external system, select the option to automatically close cases when pushing a new incident to an external system.

## Configure external connectors

Connectors let you send cases to external incident management systems. To create and manage connectors, you need the appropriate Kibana feature privileges and subscription or project feature tier. Refer to [Control access to cases](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/cases/control-case-access).

### Create a connector

You can create connectors in **Stack Management > Connectors** (see [Connectors](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/manage-connectors)) or from the case **Settings** page:
1. From the **Incident management system** list, select **Add new connector**.
2. Select the system to send cases to:
   - [IBM Resilient connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/resilient-action-type)
- [Jira connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/jira-action-type)
- [ServiceNow ITSM connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/servicenow-action-type)
- [ServiceNow SecOps connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/servicenow-sir-action-type)
- [Swimlane connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/swimlane-action-type)
- [TheHive connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/thehive-action-type)
- [Webhook - Case Management connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/cases-webhook-action-type)
3. Enter your required settings, then click **Save**.


### Edit a connector

1. Select the required connector from the incident management system list.
2. Click **Update <connector name>**.
3. Modify the connector fields as needed, then click **Save & close**.


### Set the default connector

Select a connector from the **Incident management system** list to set it as the default for new cases. You can also choose a connector when creating individual cases or in case templates.

### About field mappings

When you push a case to an external system, case fields are automatically mapped to corresponding fields in that system. For example, the case title maps to the short description in ServiceNow and the summary in Jira. Case tags map to labels in Jira, and comments map to work notes in ServiceNow.
With a Webhook - Case Management connector, you can map case fields to custom or existing fields.
When you push updates, mapped fields are either overwritten or appended, depending on the field and connector. Retrieving data from external systems is not supported.

## Add custom fields

You can add optional and required fields for customized case collaboration.
To create a custom field:
1. In the **Custom fields** section, click **Add field**.
2. You must provide a field label and type (text or toggle). You can optionally designate it as a required field and provide a default value.

When you create a custom field, it's added to all new and existing cases. In existing cases, new custom text fields initially have null values.
You can subsequently remove or edit custom fields on the **Settings** page.

## Create templates

Templates let you pre-fill case fields like severity, tags, title, description, and custom fields—speeding up case creation and ensuring consistency across your team. When creating a case, you can select a template and use its values or override them. Updating or deleting templates does not affect existing cases.
To create a template:
1. In the **Templates** section, click **Add template**.
2. Provide a template name and case severity.
3. (Optional) Add template tags and a description, values for each case field, and a case connector.


## Add observable types

<admonition title="Requirements">
  Ensure you have the appropriate [Elastic Stack subscription](https://www.elastic.co/pricing) or [Serverless project feature tier](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/deploy/elastic-cloud/project-settings).
</admonition>

In addition to the preset observable types (such as IP addresses and file hashes), you can create up to 10 custom types to match your investigation needs. Custom observable types appear as options when you [add observables to cases](/elastic/docs-builder/docs/3016/explore-analyze/cases/attach-objects-to-cases#add-case-observables).
1. In the **Observable types** section, click **Add observable type**.
2. Enter a descriptive label for the observable type, then click **Save**.

You can edit or remove custom observable types from the **Settings** page. Be aware that deleting a custom observable type also deletes all instances of it from your cases.