Security Case Management
If you're running Elastic Security and need to manage SOC cases programmatically, this handles the full lifecycle through Kibana's Cases API. Create cases after alert triage, search by hostname or agent ID, attach alerts in batches, add investigation notes, update severity and status. It's hardcoded to securitySolution owner, so don't try using it for Observability cases. The execution rules are refreshingly blunt: start immediately, report API output verbatim, don't invent details or round numbers. Includes multi-step workflow examples like "find cases for a host" and batch alert attachment with automatic rate limiting. Requires Node.js 22+ and either API key or username/password auth to your Kibana instance.
- GitHub stars
- 503
- last updated
- Jun 1, 2026
Install
$ npx -y skills add elastic/agent-skills --skill security-case-management --agent claude-codeInstalls into .claude/skills of the current project.
Files
Case Management
Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates
exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,
and pushed to external incident management systems via connectors.
Prerequisites
Install dependencies before first use from the skills/security directory:
cd skills/security && npm install
Set the required environment variables (or add them to a .env file in the workspace root):
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
When to use
- Creating a case after alert triage (classification, IOCs, findings)
- Searching for existing cases to correlate related alerts
- Adding investigation comments or attaching alerts to an existing case
- Updating case status or severity
- Listing recent cases for review
When NOT to use
- Do not use this skill for Observability or Elasticsearch cases — it hardcodes
owner: securitySolution - Do not use for cases outside the Security solution space
Execution rules
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/elastic/agent-skills
- Categories
- Security, AI & Agent Building
- License
- Apache-2.0
- First seen
- Jun 11, 2026
More from elastic/agent-skills
All 57- Cloud Create Project
- Security Detection Rule Management
- Observability Edot Dotnet Instrument
- Observability Edot Dotnet Migrate
- Observability Edot Java Instrument
- Observability Edot Java Migrate
- Observability Edot Python Instrument
- Observability Edot Python Migrate
- Security Generate Security Sample Data
- Observability K8s Investigation
- Observability Llm Obs
- Observability Logs Search
- Cloud Manage Project
- Observability Manage Slos
- Cloud Network Security
- Observability Service Health
- Cloud Setup
- Kibana Streams
- Elasticsearch Esql5.2K
- Elasticsearch Onboarding4.7K
- Kibana Dashboards4.6K
- Security Case Management4.4K
- Kibana Alerting Rules4.3K
- Kibana Agent Builder4.3K
Recommended
More Security
cloud-securityhypnguyen1209/offensive-claudeCloud penetration testing — AWS/Azure/GCP privilege escalation, container escape, Kubernetes attacks, serverless exploitation, IaC misconfigurations0skills.sh installs
V3 Security Overhaulspencermarx/open-code-reviewComplete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for sec0skills.sh installs
architecting-securitytelagod/code-abyss安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling0skills.sh installs