Create cases

To create a new case:

Find Cases using the global search field, then select Create case.

Note

Cases are scoped by solution. On Elastic Stack, search for Security/Cases or Observability/Cases, or go to Stack Management → Cases. On Serverless, search for Cases in Elastic Security or Observability.
(Optional) Select a template to pre-fill values.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Create and manage templates on the Templates page. Refer to Case templates.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.0 to 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Create and manage templates in case settings.
Enter a name, severity, and description. Optionally add a category, assignees, tags, and additional fields.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Additional fields come from the field library.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.0 to 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Additional fields are custom fields configured in case settings.
(Optional) Adjust sync and extraction options, or leave the defaults:
- Sync alert status syncs alert statuses with the case status (on by default).
- Auto-extract observables extracts observables from attached alerts (on by default, requires appropriate subscription). The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Auto-extraction can also run for cases created through the Cases API or automations. For details, refer to Auto-extract observables.
  
  Note
  
  Auto-extracting observables is only available in Elastic Security Serverless and Elastic Security 9.2+.
(Optional) Select a connector to send the case to an external system. When you create the case, it's pushed to that system automatically.
Select Create case.

After creating a case, attach objects such as alerts, files, observables, and visualizations. To notify users when they're assigned to a case, set up email notifications.

Set up email notifications

Set up email notifications to alert users when they're assigned to a case, so they can respond promptly.

Elastic Cloud

Add the email domains to the notifications domain allowlist.

You do not need to configure an email connector or update Kibana user settings. The preconfigured Elastic-Cloud-SMTP connector is used by default.

Self-managed

Create a preconfigured email connector.

Note

Email notifications support only preconfigured email connectors, which are defined in the kibana.yml file. For examples, refer to Email connectors and Configure email accounts for well-known services.

Set the notifications.connectors.default.email Kibana setting to the name of your email connector.

notifications.connectors.default.email: 'mail-dev'

xpack.actions.preconfigured:
  mail-dev:
    name: preconfigured-email-notification-maildev
    actionTypeId: .email
    config:
      service: other
      from: from address
      host: host name
      port: port number
      secure: true/false
      hasAuth: true/false

If you want the email notifications to contain links back to the case, configure the server.publicBaseUrl setting.

Case visibility across solutions

A case created in one solution is only visible within that solution:

Stack Management cases are not visible in Observability or Elastic Security
Observability cases are not visible in Stack Management or Elastic Security
Elastic Security cases are not visible in Stack Management or Observability

Alerts also can't cross solution boundaries. You can only attach alerts from the same solution to cases. For example, you can't attach Observability alerts to an Elastic Security case.