Loading

Create cases

To create a new case:

  1. Find Cases using the global search field, then select Create case.

    Note

    Cases are scoped by solution. On Elastic Stack, search for Security/Cases or Observability/Cases, or go to Stack Management → Cases. On Serverless, search for Cases in Elastic Security or Observability.

  2. (Optional) Select a template to pre-fill values.

  3. Enter a name, severity, and description. Optionally add a category, assignees, tags, and additional fields.

  4. (Optional) Adjust sync and extraction options, or leave the defaults:

    • Sync alert status syncs alert statuses with the case status (on by default).

    • Auto-extract observables extracts observables from attached alerts (on by default, requires appropriate subscription). Auto-extraction can also run for cases created through the Cases API or automations. For details, refer to Auto-extract observables.

      Note

      Auto-extracting observables is only available in Elastic Security Serverless and Elastic Security 9.2+.

  5. (Optional) Select a connector to send the case to an external system. When you create the case, it's pushed to that system automatically.

  6. Select Create case.

After creating a case, attach objects such as alerts, files, observables, and visualizations. To notify users when they're assigned to a case, set up email notifications.

Set up email notifications to alert users when they're assigned to a case, so they can respond promptly.

Add the email domains to the notifications domain allowlist.

You do not need to configure an email connector or update Kibana user settings. The preconfigured Elastic-Cloud-SMTP connector is used by default.

  1. Create a preconfigured email connector.

    Note

    Email notifications support only preconfigured email connectors, which are defined in the kibana.yml file. For examples, refer to Email connectors and Configure email accounts for well-known services.

  2. Set the notifications.connectors.default.email Kibana setting to the name of your email connector.

    notifications.connectors.default.email: 'mail-dev'

xpack.actions.preconfigured:
  mail-dev:
    name: preconfigured-email-notification-maildev
    actionTypeId: .email
    config:
      service: other
      from: from address
      host: host name
      port: port number
      secure: true/false
      hasAuth: true/false

  3. If you want the email notifications to contain links back to the case, configure the server.publicBaseUrl setting.

A case created in one solution is only visible within that solution:

  • Stack Management cases are not visible in Observability or Elastic Security
  • Observability cases are not visible in Stack Management or Elastic Security
  • Elastic Security cases are not visible in Stack Management or Observability

Alerts also can't cross solution boundaries. You can only attach alerts from the same solution to cases. For example, you can't attach Observability alerts to an Elastic Security case.