Cases for Elastic Security

Create cases to collect and share information about security incidents and investigations. You can attach alerts, document findings, and collaborate with your SOC team, all in one place. Cases also integrate with external ticketing systems like Jira, ServiceNow, and IBM Resilient, so you can escalate and track incidents across your security workflow.

Beyond the core case functionality, Elastic Security lets you:

• Stack 9.4+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Set an alert closing reason when closing a case
• View case metrics
• Attach events from Timeline
• Add threat intelligence indicators
• Attach Timelines to preserve investigation context
• Stack Preview 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Preview Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Attach entities under investigation

If Sync alert status is on, closing the case opens the Select alert close reason popup, where you can choose how attached detection alerts are closed. You can close the attached alerts without a reason, or specify an alert closing reason.

The available options match the closing reasons from the Alerts page, including any custom closing reasons defined in the securitySolution:detectionsCloseReasons advanced setting.

Alerts that are already closed keep their existing reason; only open and acknowledged attached alerts are updated.

Select an existing case to access its summary. The case summary, located under the case title, contains metrics that summarize alert information and response times:

• Total alerts: Total number of unique alerts attached to the case
• Associated users: Total number of unique users represented in the attached alerts
• Associated hosts: Total number of unique hosts represented in the attached alerts
• Total connectors: Total number of connectors added to the case
• Case created: Date and time the case was created
• Open duration: Time elapsed since the case was created
• In progress duration: How long the case has been in the In progress state
• Duration from creation to close: Time elapsed from case creation to closure

Use these metrics to assess incident scope, track response efficiency, and identify trends across cases for process improvements.

Attach events to cases to document suspicious activity and preserve evidence for your investigation. You can add events from Timeline or from the Events tab on the Hosts, Network, or Users pages. This helps you build a chronological record of what happened, share findings with your team, and support post-incident analysis.

View attached events in the case's Events tab, where they're organized from newest to oldest. You can find the Events tab in the following places:

• Stack 9.3+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. : Go to the case's details page, then select the Attachments tab.
• Stack 9.0-9.2 The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.0 to 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. : Go to the case's details page.

Attach threat intelligence indicators to cases to document evidence of compromise and connect your investigation to known threats. This helps you correlate alerts with threat actor tactics, track IOCs across related incidents, and build a complete picture of an attack.

Attach Timelines to cases to preserve your investigation context and share it with your team. When you attach a Timeline, other analysts can see the exact queries, filters, and events you examined, making it easier to collaborate, hand off investigations, or document your evidence trail.

Instead of inserting a link, you can attach a Timeline as a structured, filterable table in its own section on the case's Attachments tab. From a Timeline, select Attach to case → Attach to new case or Attach to existing case. You can also attach a Timeline from the case itself: select Attach → Timeline from the case's Activity tab.

Attach a host, user, or service entity to a case to connect it to what's under investigation. From an entity's details flyout, select Take action → Add to new case or Add to existing case.

Attached entities appear in their own Entities section on the case's Attachments tab. To access this section, you need the read privilege for the .entities.v2.latest.security_* index.

Use Elastic Workflows to create, update, and close cases programmatically as part of a larger SOC automation. The Triage a security alert into a case workflow shows the end-to-end pattern: open a case when a detection alert fires, attach the alert and observables, isolate the host, and notify the on-call analyst. For the full cases.* step reference, refer to Cases action steps.

Detection rules can also create cases directly, without a workflow, using the Cases connector rule action.