Security Case Management

Handles case management for Elastic Security through the Kibana Cases API. You can create, update, and track SOC cases that automatically scope to the securitySolution space. Cases link directly to alerts, can be assigned to analysts, and push to external ticketing systems via connectors. It's part of the broader elastic/agent-skills collection, which makes sense since case management is usually just one piece of a security workflow. Worth noting you'll need to install dependencies from the skills/security directory and set up environment variables before it works. If you're already running Elastic Security and want programmatic case handling instead of clicking through Kibana, this gets you there.

skills.sh installs: 4.4K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill security-case-management --agent claude-code

Installs into .claude/skills of the current project.

Files

Case Management

Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts, and pushed to external incident management systems via connectors.

Prerequisites

Install dependencies before first use from the skills/security directory:

cd skills/security && npm install

Set the required environment variables (or add them to a .env file in the workspace root):

export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"

When to use

Creating a case after alert triage (classification, IOCs, findings)
Searching for existing cases to correlate related alerts
Adding investigation comments or attaching alerts to an existing case
Updating case status or severity
Listing recent cases for review

When NOT to use

Do not use this skill for Observability or Elasticsearch cases — it hardcodes owner: securitySolution
Do not use for cases outside the Security solution space