Loading

Create case templates

Create a case template to pre-fill case defaults whenever your team opens a similar case. On the Configuration tab, you also set the template's identity, optional case settings, and an optional external connector. This guide shows you how to configure a template and author its YAML.

The template editor has a YAML pane and a preview pane with Fields and Configuration tabs:

  • Fields: Define case defaults and custom fields in YAML, and preview how they render on a case. Changes in the preview sync back to the YAML.
  • Configuration: Set the template's identity, case settings, and an optional external connector. These values aren't part of the YAML definition.

To create a template:

  1. Find Cases using the global search field, then select Templates > Create.

    Cases are scoped by solution. On Elastic Stack, search for Security/Cases or Observability/Cases, or go to Stack Management > Cases. On Serverless, search for Cases in Elastic Security or Observability.

  2. On the Fields tab, define case defaults and the fields to pre-fill. Add reusable fields from your field library. Refer to the YAML schema reference for supported keys.

  3. On the Configuration tab, enter a template name. Optionally add a description, tags, case settings (Sync alerts and Extract observables), and an external connector.

    Note

    Extract observables is available in Elastic Security only.

  4. Click Create. The template is enabled by default so it's available when creating a case.

As you edit, the editor validates your YAML and suggests values. While you're editing, your changes are saved as a draft so you don't lose your work. Select Reset to discard the draft and return to the last saved version.

Global fields appear on every case automatically, so you don't add them to a template. To include a reusable field, add it in the YAML on the Fields tab. Use $ref with the field's name (not its label). Use the name in YAML when you author templates. Use the field's label when you search cases.

For example, to add the summary field from the library:

fields:
  - $ref: summary

A reference can also use a different name for that template, or override the field's default value, without changing the original field in the library:

fields:
  - $ref: summary
    name: incident_summary
    metadata:
      default: A different default for this template

From here, you can use the template on cases and update it later if your workflow changes.