skills.rest
patrykkopycinski
patrykkopycinskiCOMMUNITY
Explore all skills by this author →
GitHub

security-case-management

Manage Elastic Security investigation cases and attach related alerts.

6|Updated Feb 20, 2026
Search Tags:#investigation#security#incident response#alerts#elasticsearch#case management#kibana
One-click install
npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-case-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-case-management
Source: https://github.com/patrykkopycinski/elastic-cursor-plugin/tree/main/skills/security-case-management
Command: npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-case-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill streamlines the manual workflow of creating, tracking, and closing security investigation cases in Elastic Security by guiding analysts through case creation, alert attachment, investigation documentation, and final resolution.

Core Features & Use Cases

  • Case lifecycle management: List existing cases by status and severity, create new cases, select and retrieve case details.
  • Alert triage and attachment: Find relevant alerts, attach alert objects or references to cases, and add investigative comments.
  • Investigation documentation & closure: Record findings, enrichment results, IOCs, containment actions, and close or escalate cases with a final summary.
  • Use Case: Triage a critical detection by creating a high-severity case, attaching matching alerts, documenting evidence and remediation steps, and closing the case with recommendations for follow-up detections.

Quick Start

Create a new high-severity security case for the suspicious alert, attach matching alerts, add investigation notes, and close the case when resolved.

Frequently Asked Questions about security-case-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage security investigation cases in Elasticsearch and Kibana?▼

To manage security investigation cases in Elasticsearch, you can use guided workflows to create cases by severity, attach matching alerts, document findings, and close incidents within Kibana. This requires an ES_URL, ES_API_KEY, and KIBANA_URL.

Can I attach Elastic Security alerts directly to an existing incident case?▼

Yes, you can attach Elastic Security alerts directly to an existing incident case. The workflow supports finding relevant alerts and linking them as objects or references to cases, enabling structured alert triage and tracking within Kibana.

What permissions do I need to automate incident response case creation in Elastic Security?▼

To automate incident response case creation in Elastic Security, you need API keys with permissions to call manage_cases, triage_alerts, and esql_query. You must also configure ES_URL and KIBANA_URL to interact with the Elasticsearch and Kibana Cases APIs.

What is the best way to document investigation findings and IOCs during alert triage?▼

The best way to document investigation findings during alert triage is to add investigative comments directly to a security case. You can record enrichment results, IOCs, and containment actions within the case structure before final resolution.

Does this approach support closing and escalating cases with final remediation summaries?▼

Yes, this case management approach supports closing and escalating cases with final remediation summaries. Analysts can record recommendations for follow-up detections and document the complete incident resolution within the Elastic Security workflow.

Related Skills

Explore More Legal & Compliance Skills→
davidgeorgehopedavidgeorgehope
27

elasticsearch

Manage Elasticsearch and Kibana operations via REST API calls.

Community
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-summarization

Generate executive and technical security incident reports with MITRE ATT&CK mappings.

Official
Intermediate
wyre-technologywyre-technology
39

SentinelOne Alerts

List, search, and retrieve SentinelOne security alert details with GraphQL filters.

Official
Advanced
elasticelastic
546

security-case-management

Create, search, update, and attach alerts to SOC cases via the Kibana Cases API.

Official
Intermediate