---
title: Manage cases
description: Edit case details, perform bulk actions, and export or import cases between spaces or across stack upgrades.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/cases/manage-cases
products:
- Elastic Cloud Serverless
- Elastic Observability
- Elastic Security
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available
---
# Manage cases
Browse the case list, edit case details, and perform bulk actions like deleting or updating multiple cases. You can also export and import cases between spaces or when upgrading to a new stack version.
## View and organize the case list
- Elastic Stack: Planned
The **Cases** page lists all the cases you can access. A summary at the top of the page shows counts for open, in-progress, and closed cases, along with the average time to close.
Use the view toggle to switch between two layouts:
- **List view** (default): Shows each case as a card with its ID, title, severity, status, alert count, assignees, author, last updated date, and comment count.
- **Table view**: Shows cases in rows and columns.
The following controls are shared across both views:
- **Sort**: In List view, order cases by newest or oldest first.
- **Fields** (List view) or **Columns** (Table view): Select which optional details to show. Options include tags, category, comments, alerts, events, dates, connector, external incident, description, and custom or template fields. You can also drag to reorder them.
- **Search and filters**: Narrow the list by text, status, severity, tags, categories, assignees, solution, or date range.
## Edit case details
To view a case, go to the **Cases** page and select its name. From the case details page you can:
- Edit the description.
- Add or edit comments.
- Elastic Stack: Generally available since 9.2 Paste images directly into comments using Cmd + v (Mac) or Ctrl + v (Windows/Linux). Pasted images are preformatted in Markdown.
- Update assignees, status, and severity.
- Add or change connectors and push updates to external systems.
- Elastic Stack: Planned Edit the case title inline from the header.
- Elastic Stack: Planned [Send the case to an AI chat conversation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/cases/analyze-cases-with-ai) to summarize it or use it as context.
To attach alerts, files, observables, or visualizations to a case, refer to [Attach objects to cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/cases/attach-objects-to-cases).
### Work with the case details view
- Elastic Stack: Planned
The case details page organizes information into editable sections:
- The **description** appears in its own panel that you can collapse or expand. An indicator shows when you have unsaved draft changes.
- A collapsible sidebar groups case attributes into sections you can edit in place, each with confirm and cancel controls:
- **Attributes**: Assignees, severity, participants, tags, and category.
- **Template fields**: Custom and template fields. When you apply a template, this section's title changes to the template's name (for example, **Compromised Account**).
- **Connectors**: The external system the case is pushed to.
Collapse the sidebar to give the main case content more room.
### Filter the activity feed
- Elastic Stack: Planned
The activity feed tracks a case's comments and history. To find specific entries, use the search box, filter by type (comments or history) or author, and sort by newest or oldest first. Select **Show more** to load additional entries, or clear the filters to return to the full feed.
## Apply a template to a case
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Planned
You can apply a different [case template](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/cases/manage-case-templates) to an existing case. Open the case, select **Apply template** from the case actions menu, then choose an enabled template. Applying a template updates the case's fields. It doesn't change the case's existing connector.
## Bulk-manage cases
From the **Cases** page, select one or more cases to perform bulk actions such as deleting cases or changing their status, severity, assignees, or tags.
## Export and import cases
Use export and import to move cases between Kibana spaces. Exports are saved as newline-delimited JSON (`.ndjson`) files and include user actions, text string comments, and any attached Lens visualizations, dashboards, maps, or Discover sessions that reference a saved object.
Files, alerts, and Timelines attached to the case are **not** included. You must re-add them after importing.Before importing cases, also ensure that any referenced saved objects (such as Lens visualizations, dashboards, maps, or Discover sessions) already exist in the destination space, otherwise those references won't work.
### Export cases
1. Find **Saved Objects** in the navigation menu or by using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/find-and-organize/find-apps-and-objects).
2. Filter by type or search by case title to find the cases you want to export.
3. Select one or more cases, then click **Export**.
4. In the export dialog, keep **Include related objects** enabled to include connectors, then click **Export**.
### Import cases
1. Find **Saved Objects** in the navigation menu or by using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/explore-analyze/find-and-organize/find-apps-and-objects), then click **Import**.
2. Select the `.ndjson` file containing the exported cases.
3. Configure the import options and click **Import**.
4. Review the import log, then click **Done**.
If the imported case had connectors attached, you'll be prompted to re-authenticate them. Click **Go to connectors** and complete the required steps.