skills.rest
elastic
elasticOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-case-management

Create, search, update, and attach alerts to SOC cases via the Kibana Cases API.

546|44|Updated Mar 6, 2026
Search Tags:#security#incident response#alerting#case management#SOC#kibana
One-click install
npx skills add https://github.com/elastic/agent-skills --skill security-case-management-elastic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-case-management
Source: https://github.com/elastic/agent-skills/tree/main/skills/security/case-management
Command: npx skills add https://github.com/elastic/agent-skills --skill security-case-management-elastic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the management of Security Operations Center (SOC) cases, allowing for efficient creation, searching, updating, and linking of alerts to incidents.

Core Features & Use Cases

  • Case Creation: Quickly create new SOC cases with detailed descriptions, tags, and severity levels.
  • Case Search & Listing: Find existing cases using various filters like tags, status, or keywords, and list recent cases.
  • Alert Correlation: Attach specific alerts to existing cases for better incident tracking and investigation.
  • Case Updates: Modify case status, severity, or tags as the investigation progresses.
  • Use Case: After triaging a critical alert indicating potential malware, you can use this Skill to create a new case, assign it a 'critical' severity, and attach the alert for further investigation by the security team.

Quick Start

Use the case manager to create a new case titled "Suspicious login activity detected" with a description "User account anomaly observed on server X".

Frequently Asked Questions about security-case-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create and manage SOC cases in Kibana for incident tracking?▼

SOC case management in Kibana uses the Cases API to create, search, and update incidents with descriptions, tags, and severity levels. You can efficiently track incidents and manage triage output directly within Elastic Security.

Can I attach security alerts to existing cases for better alert correlation?▼

Yes, alert correlation allows you to attach specific alerts to existing Kibana cases. Linking alerts to incidents provides better incident tracking and centralizes the investigation context for the security team.

How do I search and filter existing SOC cases by status or tags?▼

You can search and list existing SOC cases using various filters like tags, status, and keywords. This allows you to retrieve recent cases or locate specific incidents during ongoing triage and investigation workflows.

What do I need to configure before using the Kibana Cases API for incident response?▼

You need Node.js 22+ and network access to your Kibana instance. Environment variables must be configured with the Kibana URL and authentication credentials to enable SOC case creation and management via the API.

When do I need to use SOC case management for alert triage?▼

SOC case management is needed when triaging critical alerts, such as potential malware. You create a new case, assign a severity level, and attach the alert to coordinate further investigation by the security team.

Related Skills

Explore More Software Engineering Skills→
elasticelastic
546

security-alert-triage

Automate triage of Elastic Security alerts with ES|QL queries and case management.

Official
Advanced
hmzainjamilhmzainjamil
1

Security Monitoring

Automate security monitoring, threat detection, and incident response from enterprise logs.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
patrykkopycinskipatrykkopycinski
6

security-case-management

Manage Elastic Security investigation cases and attach related alerts.

Community
Intermediate