Attach objects to cases

After creating a case, you can attach supporting materials to build a complete picture of an incident. You can attach alerts to escalate and track detections, files like screenshots or logs as evidence, observables such as IP addresses or file hashes to identify patterns, and more.

In Elastic Security, you can also attach events, threat intelligence indicators, Timelines, and entities to connect cases to known threats.

Escalate alerts and track them in a single place by attaching them to cases.

To add alerts, select More actions (…) on a single alert or use the Bulk actions menu for multiple alerts, then choose Add to a new case or Add to existing case. You can add up to 1,000 alerts to a case.

After adding alerts, you can review them under Alerts on the case's Attachments tab. Alerts are organized from oldest to newest, and you can select View details to inspect individual alerts.

After you create a case, you can upload and manage files under the Files tab. Each file can be up to 100 MiB (10 MiB for images), and a case can have up to 100 files attached.

You can also upload a file from the Activity tab. Select Attach → Upload file.

When you upload a file, a comment is added to the case activity log, and the file becomes accessible from the Files management page. To view an image, select its name in the activity or file list. To download or delete a file, or copy its hash (MD5, SHA-1, or SHA-256) to your clipboard, open the action menu .

Cases accepts the following categories of files:

If your file isn't one of these types (for example, a Microsoft Office format like .xlsx or .docx) compress it into a ZIP archive and attach the archive instead.

Observables are discrete pieces of data relevant to an investigation, such as IP addresses, file hashes, domain names, or URLs. By attaching observables to cases, you can spot patterns across incidents or events. For example, if the same malicious IP appears in multiple cases, you might be dealing with a coordinated attack or shared threat infrastructure. This correlation helps you assess the true scope of an incident and prioritize your response.

You can view and manage case observables under Observables on the case's Attachments tab. Each case supports up to 50 observables.

1. Select Add observable from the Observables tab.

2. Provide the necessary details:

   • Type: Select a type for the observable. You can choose a preset type or a custom one.
   • Value: Enter a value for the observable. The value must align with the type you select.
   • Description (Optional): Provide additional information about the observable.

3. Select Add observable.

After adding an observable to a case, you can remove or edit it using the action menu . To find related investigations, check the Similar cases tab for other cases that share the same observables.

With the appropriate subscription, you can auto-extract observables from alerts instead of adding them manually. Note that auto-extracting observables is unavailable for Observability cases.

Auto-extraction can also run for cases created outside the UI, such as with the Cases API or a Cases connector action:

• When a case template is applied, extraction follows the template's Auto-extract observables setting, which is on by default.
• For cases created directly with the Cases API, extraction is off by default. Set extractObservables to true in the create-case request to turn it on.

Add Lens visualizations to case descriptions or comments to portray event and alert data through charts and graphs. You can add them from dashboard panels or create visualizations directly in a case. To add a visualization from a dashboard, open a panel's menu, select the action menu , then Add to existing case or Add to new case.

To create a visualization in a case:

1. Click Visualization to open the dialog, then select an existing visualization from your Visualize Library or create a new one. Use an absolute time range so it remains consistent over time.
2. (Optional) Click Save to library, enter a title and description, and save to reuse the visualization elsewhere.
3. Click Save and return to go back to your case.
4. Click Preview to see how the visualization will appear, then click Add Comment to attach it.

To modify a visualization after adding it, click Open Visualization in the case comment menu.

You can also attach an existing Lens visualization by reference, which keeps a live link to the source so the case reflects the latest version whenever it's edited. Select Attach → Saved object from the case's Activity tab, search for the visualization, and select it to open it in Lens, where you can adjust it before returning to the case.

Attach an existing dashboard, map, or Discover session to a case to give teammates a direct path back to the full, interactive view.

To attach these objects:

1. Go to the case's details page, then select the Activity tab.
2. Select Attach → Saved object.
3. In the Attach saved object dialog, search for the dashboard, map, or Discover session by title. Optionally, filter by type, then select Attach next to the item you want.

The attached object appears in the case activity log and in its own section on the Attachments tab, labeled with the object's title. Dashboards and maps also show an inline snapshot when one is available. Select the title to open the full dashboard, map, or Discover session.