Loading

Control access to cases

To manage cases, users need the appropriate Kibana feature privileges. You can grant different levels of access depending on what users need to do, from full control over cases to view-only access.

The following table shows the minimum privileges required for each activity. Higher privilege levels include the access shown here. Set Cases privileges under your solution (Stack Management, Security, or Observability). Refer to the following sections for the full breakdown.

To... Minimum required privilege
View cases Cases: Read
Create and manage cases Cases: All
Be assigned to cases Cases: All (you must also log in at least once)
Manage connectors and push cases externally Cases: All + Actions and Connectors: All (under Management)
Manage case templates and the field library Cases: All + Manage templates sub-feature privilege
Add alerts to cases Cases: All + alert privileges for your solution (refer to Give access to add alerts to cases for more information)
Report on case data with the analytics indices read and view_index_metadata Elasticsearch index privileges (refer to Give access to the case analytics indices for more information)

Create or update a role, then set Cases privileges under your solution (Stack Management, Security, or Observability). To grant individual privileges, turn on Customize sub-feature privileges. For details about feature and sub-feature privileges, refer to Kibana privileges.

Create a custom role, then set Cases privileges under your solution (Security or Observability). To grant individual privileges, turn on Customize sub-feature privileges.

When Customize sub-feature privileges is on for Cases, you can grant these privileges individually. For details about feature and sub-feature privileges, refer to Kibana privileges.

Privilege Description
Delete Delete cases and comments.
Case settings Edit case settings.
Create comments & attachments Add comments to cases.
Re-open Re-open closed cases.
Assign users Assign users to cases.
Manage templates Manage case templates.
  • All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability). This grants full control over cases, including creating, deleting, and editing case settings. You can turn on Customize sub-feature privileges to limit access.
  • All for the Actions and Connectors feature under Management. This is required to create, add, delete, and modify connectors that push cases to external systems.
  • All for the Cases feature under the appropriate solution (Security or Observability).
  • All for the Actions and Connectors feature under Management. This is required to create, add, delete, and modify case connectors and send updates to external systems.

All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.

All for the Cases feature under the appropriate solution (Security or Observability).

Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.

Read for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

Read for the Cases feature under the appropriate solution (Security or Observability).

To create, edit, delete, import, and export case templates and field library entries, grant the following privileges. Users without Manage templates can still select and apply enabled templates when creating or updating a case.

  1. Set All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).
  2. Turn on Customize sub-feature privileges.
  3. Enable Manage templates.
  1. Set All for the Cases feature under the appropriate solution (Security or Observability).
  2. Turn on Customize sub-feature privileges.
  3. Enable Manage templates.
  • All for the Cases feature under the appropriate solution (Security or Observability).
  • To work with alerts in cases:
    • Security: Read or All for the Security → Alerts feature. For what each level allows, refer to Detections privileges.
    • Observability: Read for Observability
  • All for the Cases feature under the appropriate solution (Security or Observability).
  • Read for a solution that has alerts (for example, Observability or Security).

To let users report on case data, grant them read access to the case analytics indices. Kibana Cases feature privileges don't apply to these indices, so grant access with Elasticsearch index privileges instead.

Elasticsearch stores case analytics data in three hidden indices:

Index Use it to report on
.cases Your cases and their current state, such as status, severity, assignees, and timing metrics.
.cases-activity What happened to cases over time, such as status changes, comments, and who made each change.
.cases-attachments What's attached to cases, such as alerts, comments, files, dashboards, and visualizations.

By default, only users with sufficient Elasticsearch privileges (such as a superuser) can read them. To give other users access, grant them the required privileges on the indices directly.

To grant access, create an Elasticsearch role with the read and view_index_metadata privileges on the analytics indices, and set allow_restricted_indices to true. Then assign the role to your users.

For example, the following request creates a cases_analytics_reader role with read access to all three indices:

				PUT _security/role/cases_analytics_reader
					{
  "indices": [
    {
      "names": [".cases", ".cases-activity", ".cases-attachments"],
      "privileges": ["read", "view_index_metadata"],
      "allow_restricted_indices": true
    }
  ]
}
Warning

A role with read access to these indices can query case data across all spaces and solutions, regardless of which spaces or solutions the user works in. Grant this access carefully, and filter by space_id and owner in your queries and visualizations to limit scope.

Grant your role at least read and view_index_metadata privileges on the case analytics indices. Each solution and space has its own set of indices, so use the .internal.cases* pattern to cover them all, or target specific indices by name. To find the right index names, refer to Case analytics indices.

None for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

None for the Cases feature under the appropriate solution (Security or Observability).