﻿---
title: Open and manage cases in Kibana
description: To perform these tasks, you must have full access to the appropriate case features in Kibana. Open a new case to keep track of issues and share their...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/manage-cases
products:
  - Kibana
---

# Open and manage cases in Kibana
To perform these tasks, you must have [full access](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/setup-cases) to the appropriate case features in Kibana.

## Open a new case

Open a new case to keep track of issues and share their details with colleagues.
1. Go to **Management > Stack Management > Cases**, then click **Create case**.
   ![Create a case in Stack Management](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/images/kibana-cases-create.png)
2. If you defined [templates](/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/manage-cases-settings#case-templates), you can optionally select one to use its default field values.
3. Give the case a name, severity, and description.
   <tip>
   In the `Description` area, you can use [Markdown](https://www.markdownguide.org/cheat-sheet) syntax to create formatted text.
   </tip>
4. Optionally, add a category, assignees, and tags. You can add users only if they meet the necessary [prerequisites](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/setup-cases).
5. If you defined any [custom fields](/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/manage-cases-settings#case-custom-fields), they appear in the **Additional fields** section.
6. For the **External incident management system**, select a connector. For more information, refer to [External incident management systems](/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/cases/manage-cases-settings#case-connectors).
7. After you’ve completed all of the required fields, click **Create case**.

`stack: preview` `serverless: preview` Alternatively, you can configure your rules to automatically create cases by using [case actions](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/cases-action-type). By default, the rule adds all of the alerts within a specified time window to a single case. You can optionally choose a field to group the alerts and create separate cases for each group. You can also choose whether you want the rule to reopen cases or open new ones when the time window elapses.

## Add email notifications

You can configure email notifications that occur when users are assigned to cases.
For Kibana on Elastic Cloud:
1. Add the email domains to the [notifications domain allowlist](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/alerts-cases/alerts).
   You do not need to take any more steps to configure an email connector or update Kibana user settings, since the preconfigured Elastic-Cloud-SMTP connector is used by default.

For self-managed Kibana:
1. Create a preconfigured email connector.
   <note>
   At this time, email notifications support only preconfigured connectors, which are defined in the [`kibana.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/stack-settings) file. For examples, refer to [Email connectors](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/pre-configured-connectors#preconfigured-email-configuration) and [Configure email accounts for well-known services](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/email-action-type#configuring-email).
   </note>
2. Set the `notifications.connectors.default.email` Kibana setting in kibana.yml to the name of your email connector.
   ```js
   notifications.connectors.default.email: ‘mail-dev’

   xpack.actions.preconfigured:
     mail-dev:
       name: preconfigured-email-notification-maildev
       actionTypeId: .email
       config:
         service: other
         from: from address
         host: host name
         port: port number
         secure: true/false
         hasAuth: true/false
   ```
3. If you want the email notifications to contain links back to the case, you must configure the [server.publicBaseUrl](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/configuration-reference/general-settings#server-publicbaseurl) setting.

When you subsequently add assignees to cases, they receive an email.

## Add files

After you create a case, you can upload and manage files on the **Files** tab:
![A list of files attached to a case](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/images/kibana-cases-files.png)

The acceptable file types and sizes are affected by your [case settings](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/configuration-reference/general-settings).
To download or delete the file or copy the file hash to your clipboard, open the action menu (…). The available hash functions are MD5, SHA-1, and SHA-256.
When you upload a file, a comment is added to the case activity log. To view images, click their name in the activity or file list.
<note>
  Uploaded files are also accessible in **Stack Management > Files**. When you export cases as [saved objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/find-and-organize/saved-objects), the case files are not exported.
</note>


## Add visualizations

You can also optionally add visualizations. For example, you can portray event and alert data through charts and graphs.
![Adding a visualization as a comment within a case](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/images/kibana-cases-visualization.png)

To add a visualization to a comment within your case:
1. Click the **Visualization** button. The **Add visualization** dialog appears.
2. Select an existing visualization from your Visualize Library or create a new visualization.
   <important>
   Set an absolute time range for your visualization. This ensures your visualization doesn’t change over time after you save it to your case and provides important context for viewers.
   </important>
3. After you’ve finished creating your visualization, click **Save and return** to go back to your case.
4. Click **Preview** to see how the visualization will appear in the case comment.
5. Click **Add Comment** to add the visualization to your case.

Alternatively, while viewing a [dashboard](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/explore-analyze/dashboards) you can open a panel’s menu then click **More > Add to existing case** or **More > Add to new case**.
After a visualization has been added to a case, you can modify or interact with it by clicking the **Open Visualization** option in the case’s comment menu.

## Manage cases

In **Management > Stack Management > Cases**, you can search cases and filter them by attributes such as assignees, categories, severity, status, and tags. You can also select multiple cases and use bulk actions to delete cases or change their attributes.
To view a case, click on its name. You can then:
- Add a new comment.
- Edit existing comments and the description.
- Add or remove assignees.
- Add a connector.
- Send updates to external systems (if external connections are configured).
- Edit the category and tags.
- Refresh the case to retrieve the latest updates.
- Change the status.
- Change the severity.
- Close or delete the case.
- Reopen a closed case.