# Security Case Management

Create, search, update, and manage SOC cases via the Kibana Cases API.

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Writing
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-case-management -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-case-management -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-case-management -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-case-management -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Case Management

Manage SOC cases through the Kibana Cases API. All cases are scoped to `securitySolution`, this skill operates
exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,
and pushed to external incident management systems via connectors.

## Prerequisites

Install dependencies before first use from the `skills/security` directory:

```bash
cd skills/security && npm install
```

Set the required environment variables (or add them to a `.env` file in the workspace root):

```bash
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
```

## When to use

- Creating a case after alert triage (classification, IOCs, findings)
- Searching for existing cases to correlate related alerts
- Adding investigation comments or attaching alerts to an existing case
- Updating case status or severity
- Listing recent cases for review

## When NOT to use

- Do not use this skill for Observability or Elasticsearch cases, it hardcodes `owner: securitySolution`
- Do not use for cases outside the Security solution space

## Execution rules

- Start executing tools immediately, do not read SKILL.md, browse the workspace, or list files first.
- Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do
  not abbreviate case IDs, truncate titles, invent details, or round numbers.
- When the API returns zero results, state that explicitly, do not guess at possible results.
- When listing or finding cases, report the **exact total count** from the API response and present each case with its
  verbatim title, severity, and status.

## Quick start

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/security/skills/case-management/SKILL.md