---
title: Create cases
description: Create cases to track incidents, attach alerts and files, assign team members, and push updates to external systems.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/cases/create-cases
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Create cases
To create a new case:
1. Find **Cases** using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/find-and-organize/find-apps-and-objects), then select **Create case**.
   <note>
   Cases are [scoped by solution](#cases-limitations). On Elastic Stack, search for `Security/Cases` or `Observability/Cases`, or go to **Stack Management** → **Cases**. On Serverless, search for `Cases` in Elastic Security or Observability.
   </note>
2. (Optional) Select a template to pre-fill values.
   - <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> Create and manage templates on the **Templates** page. Refer to [Case templates](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/cases/manage-case-templates).
- <applies-to>Elastic Stack: Generally available from 9.0 to 9.4</applies-to> Create and manage templates in [case settings](/elastic/docs-content/pull/7600/explore-analyze/cases/configure-case-settings#case-templates).
3. Enter a name, severity, and description. Optionally add a category, [assignees](/elastic/docs-content/pull/7600/explore-analyze/cases/control-case-access#give-assignee-access), tags, and additional fields.
   - <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> Additional fields come from the [field library](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/cases/create-case-field-library).
- <applies-to>Elastic Stack: Generally available from 9.0 to 9.4</applies-to> Additional fields are [custom fields](/elastic/docs-content/pull/7600/explore-analyze/cases/configure-case-settings#case-custom-fields) configured in case settings.
4. (Optional) Adjust sync and extraction options, or leave the defaults:
   - **Sync alert status** syncs alert statuses with the case status (on by default).
- **Auto-extract observables** extracts observables from attached alerts (on by default, requires appropriate subscription). <applies-to>Elastic Stack: Planned</applies-to> Auto-extraction can also run for cases created through the Cases API or automations. For details, refer to [Auto-extract observables](/elastic/docs-content/pull/7600/explore-analyze/cases/attach-objects-to-cases#cases-auto-extract-observables).
  <note>
  Auto-extracting observables is only available in Elastic Security Serverless and Elastic Security 9.2+.
  </note>
5. (Optional) Select a [connector](/elastic/docs-content/pull/7600/explore-analyze/cases/configure-case-settings#case-connectors) to send the case to an external system. When you create the case, it's pushed to that system automatically.
6. Select **Create case**.

After creating a case, [attach objects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/cases/attach-objects-to-cases) such as alerts, files, observables, and visualizations. To notify users when they're assigned to a case, [set up email notifications](#add-case-notifications).

## Set up email notifications

Set up email notifications to alert users when they're assigned to a case, so they can respond promptly.
<tab-set>
  <tab-item title="Elastic Cloud">
    Add the email domains to the [notifications domain allowlist](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/explore-analyze/alerting/alerts).You do not need to configure an email connector or update Kibana user settings. The preconfigured Elastic-Cloud-SMTP connector is used by default.
  </tab-item>

  <tab-item title="Self-managed">
    1. Create a preconfigured email connector.
       <note>
       Email notifications support only [preconfigured email connectors](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/pre-configured-connectors), which are defined in the [`kibana.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7600/deploy-manage/stack-settings) file. For examples, refer to [Email connectors](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/pre-configured-connectors#preconfigured-email-configuration) and [Configure email accounts for well-known services](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/email-action-type#configuring-email).
       </note>
    2. Set the `notifications.connectors.default.email` Kibana setting to the name of your email connector.
       ```yaml
       notifications.connectors.default.email: 'mail-dev'

       xpack.actions.preconfigured:
         mail-dev:
           name: preconfigured-email-notification-maildev
           actionTypeId: .email
           config:
             service: other
             from: from address
             host: host name
             port: port number
             secure: true/false
             hasAuth: true/false
       ```
    3. If you want the email notifications to contain links back to the case, configure the [server.publicBaseUrl](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/configuration-reference/general-settings#server-publicbaseurl) setting.
  </tab-item>
</tab-set>


## Case visibility across solutions

A case created in one solution is only visible within that solution:
- **Stack Management** cases are not visible in Observability or Elastic Security
- **Observability** cases are not visible in Stack Management or Elastic Security
- **Elastic Security** cases are not visible in Stack Management or Observability

Alerts also can't cross solution boundaries. You can only attach alerts from the same solution to cases. For example, you can't attach Observability alerts to an Elastic Security case.