Manage cases

Browse the case list, edit case details, and perform bulk actions like deleting or updating multiple cases. You can also export and import cases between spaces or when upgrading to a new stack version.

The Cases page lists all the cases you can access. A summary at the top of the page shows counts for open, in-progress, and closed cases, along with the average time to close.

Use the view toggle to switch between two layouts:

• List view (default): Shows each case as a card with its ID, title, severity, status, alert count, assignees, author, last updated date, and comment count.
• Table view: Shows cases in rows and columns.

The following controls are shared across both views:

• Sort: In List view, order cases by newest or oldest first.
• Fields (List view) or Columns (Table view): Select which optional details to show. Options include tags, category, comments, alerts, events, dates, connector, external incident, description, and custom or template fields. You can also drag to reorder them.
• Search and filters: Narrow the list by text, status, severity, tags, categories, assignees, solution, or date range.

To view a case, go to the Cases page and select its name. From the case details page you can:

• Edit the description.
• Add or edit comments.
• Paste images directly into comments using ⌘Cmd + v (Mac) or ⌃Ctrl + v (Windows/Linux). Pasted images are preformatted in Markdown.
• Update assignees, status, and severity.
• Add or change connectors and push updates to external systems.
• Edit the case title inline from the header.
• Send the case to an AI chat conversation to summarize it or use it as context.

To attach alerts, files, observables, or visualizations to a case, refer to Attach objects to cases.

The case details page organizes information into editable sections:

• The description appears in its own panel that you can collapse or expand. An indicator shows when you have unsaved draft changes.

• A collapsible sidebar groups case attributes into sections you can edit in place, each with confirm and cancel controls:

  • Attributes: Assignees, severity, participants, tags, and category.
  • Template fields: Custom and template fields. When you apply a template, this section's title changes to the template's name (for example, Compromised Account).
  • Connectors: The external system the case is pushed to.

  Collapse the sidebar to give the main case content more room.

The activity feed tracks a case's comments and history. To find specific entries, use the search box, filter by type (comments or history) or author, and sort by newest or oldest first. Select Show more to load additional entries, or clear the filters to return to the full feed.

You can apply a different case template to an existing case. Open the case, select Apply template from the case actions menu, then choose an enabled template. Applying a template updates the case's fields. It doesn't change the case's existing connector.

From the Cases page, select one or more cases to perform bulk actions such as deleting cases or changing their status, severity, assignees, or tags.

Use export and import to move cases between Kibana spaces. Exports are saved as newline-delimited JSON (.ndjson) files and include user actions, text string comments, and any attached Lens visualizations, dashboards, maps, or Discover sessions that reference a saved object.

1. Find Saved Objects in the navigation menu or by using the global search field.
2. Filter by type or search by case title to find the cases you want to export.
3. Select one or more cases, then click Export.
4. In the export dialog, keep Include related objects enabled to include connectors, then click Export.

1. Find Saved Objects in the navigation menu or by using the global search field, then click Import.
2. Select the .ndjson file containing the exported cases.
3. Configure the import options and click Import.
4. Review the import log, then click Done.

If the imported case had connectors attached, you'll be prompted to re-authenticate them. Click Go to connectors and complete the required steps.