Control access to cases

Create or update a role, then set Cases privileges under your solution (Stack Management, Security, or Observability). To grant individual privileges, turn on Customize sub-feature privileges. For details about feature and sub-feature privileges, refer to Kibana privileges.

Create a custom role, then set Cases privileges under your solution (Security or Observability). To grant individual privileges, turn on Customize sub-feature privileges.

• All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability). This grants full control over cases, including creating, deleting, and editing case settings. You can turn on Customize sub-feature privileges to limit access.
• All for the Actions and Connectors feature under Management. This is required to create, add, delete, and modify connectors that push cases to external systems.

• All for the Cases feature under the appropriate solution (Security or Observability).
• All for the Actions and Connectors feature under Management. This is required to create, add, delete, and modify case connectors and send updates to external systems.

All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.

All for the Cases feature under the appropriate solution (Security or Observability).

Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.

Read for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

Read for the Cases feature under the appropriate solution (Security or Observability).

1. Set All for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).
2. Turn on Customize sub-feature privileges.
3. Enable Manage templates.

1. Set All for the Cases feature under the appropriate solution (Security or Observability).
2. Turn on Customize sub-feature privileges.
3. Enable Manage templates.

• All for the Cases feature under the appropriate solution (Security or Observability).
• To work with alerts in cases:
  • Security: Read or All for the Security → Alerts feature. For what each level allows, refer to Detections privileges.
  • Observability: Read for Observability

• All for the Cases feature under the appropriate solution (Security or Observability).
• Read for a solution that has alerts (for example, Observability or Security).

Elasticsearch stores case analytics data in three hidden indices:

By default, only users with sufficient Elasticsearch privileges (such as a superuser) can read them. To give other users access, grant them the required privileges on the indices directly.

To grant access, create an Elasticsearch role with the read and view_index_metadata privileges on the analytics indices, and set allow_restricted_indices to true. Then assign the role to your users.

For example, the following request creates a cases_analytics_reader role with read access to all three indices:

PUT _security/role/cases_analytics_reader
{
  "indices": [
    {
      "names": [".cases", ".cases-activity", ".cases-attachments"],
      "privileges": ["read", "view_index_metadata"],
      "allow_restricted_indices": true
    }
  ]
}

Grant your role at least read and view_index_metadata privileges on the case analytics indices. Each solution and space has its own set of indices, so use the .internal.cases* pattern to cover them all, or target specific indices by name. To find the right index names, refer to Case analytics indices.

None for the Cases feature under the appropriate solution (Stack Management, Security, or Observability).

None for the Cases feature under the appropriate solution (Security or Observability).