---
title: Control access to cases
description: Create custom roles and configure Kibana feature privileges to control access to cases, and grant read access to the case analytics indices.
url: https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/control-case-access
products:
- Elastic Cloud Serverless
- Elastic Observability
- Elastic Security
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available
---
# Control access to cases
To manage cases, users need the appropriate Kibana feature privileges. You can grant different levels of access depending on what users need to do, from full control over cases to view-only access.
## Privileges quick reference
The following table shows the minimum privileges required for each activity. Higher privilege levels include the access shown here. Set **Cases** privileges under your solution (**Stack Management**, **Security**, or **Observability**). Refer to the following sections for the full breakdown.
| To... | Minimum required privilege |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| View cases | **Cases: Read** |
| Create and manage cases | **Cases: All** |
| Be assigned to cases | **Cases: All** (you must also log in at least once) |
| Manage connectors and push cases externally | **Cases: All** + **Actions and Connectors: All** (under **Management**) |
| Manage case templates and the field library Elastic Stack: Planned Elastic Cloud Serverless: Generally available | **Cases: All** + **Manage templates** sub-feature privilege |
| Add alerts to cases | **Cases: All** + alert privileges for your solution (refer to [Give access to add alerts to cases](#give-alerts-access) for more information) |
| Report on case data with the analytics indices | **read** and **view_index_metadata** Elasticsearch index privileges (refer to [Give access to the case analytics indices](#give-analytics-access) for more information) |
## Create custom roles for cases
[Create or update a role](https://www.elastic.co/elastic/docs-builder/docs/3739/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management), then set **Cases** privileges under your solution (**Stack Management**, **Security**, or **Observability**). To grant individual privileges, turn on **Customize sub-feature privileges**. For details about feature and sub-feature privileges, refer to [Kibana privileges](https://www.elastic.co/elastic/docs-builder/docs/3739/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges).
[Create a custom role](https://www.elastic.co/elastic/docs-builder/docs/3739/deploy-manage/users-roles/serverless-custom-roles), then set **Cases** privileges under your solution (**Security** or **Observability**). To grant individual privileges, turn on **Customize sub-feature privileges**.
## Customize sub-feature privileges for cases
When **Customize sub-feature privileges** is on for **Cases**, you can grant these privileges individually. For details about feature and sub-feature privileges, refer to [Kibana privileges](https://www.elastic.co/elastic/docs-builder/docs/3739/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges).
| Privilege | Description |
|---------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|
| **Delete** | Delete cases and comments. |
| **Case settings** | Edit case settings. |
| **Create comments & attachments** | Add comments to cases. |
| **Re-open** | Re-open closed cases. |
| **Assign users** | Assign users to cases. |
| **Manage templates** Elastic Stack: Planned Elastic Cloud Serverless: Generally available | Manage case templates. |
## Give full access to manage cases and settings
- `All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**). This grants full control over cases, including creating, deleting, and editing case settings. You can turn on **Customize sub-feature privileges** to limit access.
- `All` for the **Actions and Connectors** feature under **Management**. This is required to create, add, delete, and modify connectors that push cases to external systems.
- `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
- `All` for the **Actions and Connectors** feature under **Management**. This is required to create, add, delete, and modify case connectors and send updates to external systems.
## Give assignee access to cases
`All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.
`All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.
## Give view-only access to cases
`Read` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
`Read` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
## Give access to manage case templates
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Planned
To create, edit, delete, import, and export [case templates](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/create-case-templates) and [field library entries](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/create-case-field-library), grant the following privileges. Users without **Manage templates** can still select and apply enabled templates when creating or updating a case.
1. Set `All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
2. Turn on **Customize sub-feature privileges**.
3. Enable **Manage templates**.
1. Set `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
2. Turn on **Customize sub-feature privileges**.
3. Enable **Manage templates**.
## Give access to add alerts to cases
- `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
- To work with alerts in cases:
- **Security**: `Read` or `All` for the **Security → Alerts** feature. For what each level allows, refer to [Detections privileges](/elastic/docs-builder/docs/3739/solutions/security/detect-and-alert/detections-privileges#manage-alerts).
- **Observability**: `Read` for **Observability**
- `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
- `Read` for a solution that has alerts (for example, **Observability** or **Security**).
## Give access to the case analytics indices
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Preview from 9.2 to 9.4
To let users report on case data, grant them read access to the [case analytics indices](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/case-analytics-indices). Kibana Cases feature privileges don't apply to these indices, so grant access with Elasticsearch index privileges instead.
Elasticsearch stores case analytics data in three hidden indices:
| Index | Use it to report on |
|----------------------|-----------------------------------------------------------------------------------------------|
| `.cases` | Your cases and their current state, such as status, severity, assignees, and timing metrics. |
| `.cases-activity` | What happened to cases over time, such as status changes, comments, and who made each change. |
| `.cases-attachments` | What's attached to cases, such as alerts, comments, files, dashboards, and visualizations. |
By default, only users with sufficient Elasticsearch privileges (such as a superuser) can read them. To give other users access, grant them the required privileges on the indices directly.To grant access, create an Elasticsearch role with the `read` and `view_index_metadata` privileges on the analytics indices, and set `allow_restricted_indices` to `true`. Then assign the role to your users.For example, the following request creates a `cases_analytics_reader` role with read access to all three indices:
```json
{
"indices": [
{
"names": [".cases", ".cases-activity", ".cases-attachments"],
"privileges": ["read", "view_index_metadata"],
"allow_restricted_indices": true
}
]
}
```
A role with read access to these indices can query case data across all spaces and solutions, regardless of which spaces or solutions the user works in. Grant this access carefully, and filter by `space_id` and `owner` in your queries and visualizations to limit scope.
Grant your role at least `read` and `view_index_metadata` privileges on the case analytics indices. Each solution and space has its own set of indices, so use the `.internal.cases*` pattern to cover them all, or target specific indices by name. To find the right index names, refer to [Case analytics indices](/elastic/docs-builder/docs/3739/explore-analyze/cases/case-analytics-indices#case-analytics-indices-list).
## Revoke all access to cases
`None` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
`None` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).