security-case-management

Name: security-case-management
Availability: InStock
Author: elastic

Create, search, update, and attach alerts to SOC cases via the Kibana Cases API.

546|44|Updated Mar 6, 2026

Search Tags:#security #incident response #alerting #case management #SOC #kibana

Ready to run

npx skills add https://github.com/elastic/agent-skills --skill security-case-management-elastic

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-case-management
Source: https://github.com/elastic/agent-skills/tree/main/skills/security/case-management
Command: npx skills add https://github.com/elastic/agent-skills --skill security-case-management-elastic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the management of Security Operations Center (SOC) cases, allowing for efficient creation, searching, updating, and linking of alerts to incidents.

Core Features & Use Cases

Case Creation: Quickly create new SOC cases with detailed descriptions, tags, and severity levels.
Case Search & Listing: Find existing cases using various filters like tags, status, or keywords, and list recent cases.
Alert Correlation: Attach specific alerts to existing cases for better incident tracking and investigation.
Case Updates: Modify case status, severity, or tags as the investigation progresses.
Use Case: After triaging a critical alert indicating potential malware, you can use this Skill to create a new case, assign it a 'critical' severity, and attach the alert for further investigation by the security team.

Quick Start

Use the case manager to create a new case titled "Suspicious login activity detected" with a description "User account anomaly observed on server X".

Frequently Asked Questions about security-case-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create and manage SOC cases in Kibana for incident tracking?▼

SOC case management in Kibana uses the Cases API to create, search, and update incidents with descriptions, tags, and severity levels. You can efficiently track incidents and manage triage output directly within Elastic Security.

Can I attach security alerts to existing cases for better alert correlation?▼

Yes, alert correlation allows you to attach specific alerts to existing Kibana cases. Linking alerts to incidents provides better incident tracking and centralizes the investigation context for the security team.

How do I search and filter existing SOC cases by status or tags?▼

You can search and list existing SOC cases using various filters like tags, status, and keywords. This allows you to retrieve recent cases or locate specific incidents during ongoing triage and investigation workflows.

What do I need to configure before using the Kibana Cases API for incident response?▼

You need Node.js 22+ and network access to your Kibana instance. Environment variables must be configured with the Kibana URL and authentication credentials to enable SOC case creation and management via the API.

When do I need to use SOC case management for alert triage?▼

SOC case management is needed when triaging critical alerts, such as potential malware. You create a new case, assign a severity level, and attach the alert to coordinate further investigation by the security team.