security-case-management

Manage Elastic Security investigation cases and attach related alerts.

6|Updated Feb 20, 2026

Search Tags:#investigation #security #incident response #alerts #elasticsearch #case management #kibana

Ready to run

npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-case-management

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-case-management
Source: https://github.com/patrykkopycinski/elastic-cursor-plugin/tree/main/skills/security-case-management
Command: npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-case-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill streamlines the manual workflow of creating, tracking, and closing security investigation cases in Elastic Security by guiding analysts through case creation, alert attachment, investigation documentation, and final resolution.

Core Features & Use Cases

Case lifecycle management: List existing cases by status and severity, create new cases, select and retrieve case details.
Alert triage and attachment: Find relevant alerts, attach alert objects or references to cases, and add investigative comments.
Investigation documentation & closure: Record findings, enrichment results, IOCs, containment actions, and close or escalate cases with a final summary.
Use Case: Triage a critical detection by creating a high-severity case, attaching matching alerts, documenting evidence and remediation steps, and closing the case with recommendations for follow-up detections.

Quick Start

Create a new high-severity security case for the suspicious alert, attach matching alerts, add investigation notes, and close the case when resolved.

Frequently Asked Questions about security-case-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I manage security investigation cases in Elasticsearch and Kibana?▼

To manage security investigation cases in Elasticsearch, you can use guided workflows to create cases by severity, attach matching alerts, document findings, and close incidents within Kibana. This requires an ES_URL, ES_API_KEY, and KIBANA_URL.

Can I attach Elastic Security alerts directly to an existing incident case?▼

Yes, you can attach Elastic Security alerts directly to an existing incident case. The workflow supports finding relevant alerts and linking them as objects or references to cases, enabling structured alert triage and tracking within Kibana.

What permissions do I need to automate incident response case creation in Elastic Security?▼

To automate incident response case creation in Elastic Security, you need API keys with permissions to call manage_cases, triage_alerts, and esql_query. You must also configure ES_URL and KIBANA_URL to interact with the Elasticsearch and Kibana Cases APIs.

What is the best way to document investigation findings and IOCs during alert triage?▼

The best way to document investigation findings during alert triage is to add investigative comments directly to a security case. You can record enrichment results, IOCs, and containment actions within the case structure before final resolution.

Does this approach support closing and escalating cases with final remediation summaries?▼

Yes, this case management approach supports closing and escalating cases with final remediation summaries. Analysts can record recommendations for follow-up detections and document the complete incident resolution within the Elastic Security workflow.