Case Management

Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution, this skill operates exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts, and pushed to external incident management systems via connectors.

Prerequisites

Install dependencies before first use from the skills/security directory:

cd skills/security && npm install

Set the required environment variables (or add them to a .env file in the workspace root):

export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"

When to use

• Creating a case after alert triage (classification, IOCs, findings)
• Searching for existing cases to correlate related alerts
• Adding investigation comments or attaching alerts to an existing case
• Updating case status or severity
• Listing recent cases for review

When NOT to use

• Do not use this skill for Observability or Elasticsearch cases, it hardcodes owner: securitySolution
• Do not use for cases outside the Security solution space

Execution rules

• Start executing tools immediately, do not read SKILL.md, browse the workspace, or list files first.
• Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do not abbreviate case IDs, truncate titles, invent details, or round numbers.
• When the API returns zero results, state that explicitly, do not guess at possible results.
• When listing or finding cases, report the exact total count from the API response and present each case with its verbatim title, severity, and status.

Quick start