Loading

Create case templates

Create a case template to pre-fill case defaults whenever your team opens a similar case. On the Configuration tab, you also set the template's identity, optional case settings, and an optional external connector. This guide shows you how to configure a template and author its YAML.

The template editor has a YAML pane and a preview pane with Fields and Configuration tabs:

  • Fields: Define case defaults and custom fields in YAML, and preview how they render on a case. Changes in the preview sync back to the YAML. Use the Actions menu to quickly insert scaffolding for any field type, pull in a reusable field from your library, or add validation and conditional logic.
  • Configuration: Set the template's identity, case settings, and an optional external connector. These values aren't part of the YAML definition.

To create a template:

  1. Find Cases using the global search field, then select Templates → Create.

    Note

    Cases are scoped by solution. On Elastic Stack, search for Security/Cases or Observability/Cases, or go to Stack Management → Cases. On Serverless, search for Cases in Elastic Security or Observability.

  2. On the Fields tab, define case defaults and the fields to pre-fill. Use the Actions menu to insert scaffolding for a new field, reference a reusable field from your field library, or add validation and conditional logic. The preview pane updates in real time so you can see how fields look and behave before saving. Refer to the YAML schema reference for the full set of supported keys.

    Note

    A template can have up to 200 custom fields.

  3. On the Configuration tab, enter a template name. Optionally add a description, tags, case settings (Sync alerts and Extract observables), and an external connector.

    Note

    Extract observables is available in Elastic Security only.

  4. Select Create. The template is enabled by default so it's available when creating a case.

As you edit, the editor validates your YAML and suggests values. While you're editing, your changes are saved as a draft so you don't lose your work. Select Reset to discard the draft and return to the last saved version.

Global fields appear on every case automatically, so you don't add them to a template. To include a reusable field, use the Actions menu and select Field library. Search for the field by name, select it, and the correct $ref YAML is inserted for you.

If you prefer to write the reference directly, use $ref with the field's name (not its label) on the Fields tab. Use the field's label when you search cases.

For example, to add the summary field from the library:

fields:
  - $ref: summary

A reference can also use a different name for that template, or override the field's default value, without changing the original field in the library:

fields:
  - $ref: summary
    name: incident_summary
    metadata:
      default: A different default for this template

From here, you can use the template on cases and update it later if your workflow changes.