security-case-management

Manages Security Operations Center (SOC) cases through the Kibana Cases API, scoped exclusively to Elastic Security. Cases created through it appear in Kibana Security, can be assigned to analysts, linked to alerts, and pushed to external incident-management systems via connectors. Typical uses include opening a case after alert triage, searching for existing cases to correlate related alerts, adding investigation comments or attaching alerts, and updating case status or severity.

Operation runs through a case_manager script exposing subcommands: create, find, list, get, attach-alert, attach-alerts, add-comment, and update. Finding cases supports searching by hostname across title, description, and comments, or filtering by structured tags such as an agent id, typically combined with a status filter to show active cases only. The attach-alerts batch command adds automatic rate-limit retry with spacing between API calls, and both single and batch attaches require a rule id and rule name, with placeholder values allowed when they are unknown. Write operations prompt for confirmation by default, and a flag skips the prompt, which is required when an agent drives the tool.

The skill promotes structured, machine-searchable tag conventions covering classification, confidence score, MITRE ATT&CK technique, agent id, and detection rule name, along with a mapping from triage classification and score to Kibana severity, from benign at low up to malicious at critical. Strict reporting rules require copying case IDs, titles, tags, severities, and counts exactly as returned, stating zero-result cases explicitly, and reporting the exact total count. Requirements are Node.js 22 or newer, network access to Kibana, and environment variables for the Kibana URL plus either an API key or username and password, with dependencies installed from the security skills directory. Because it hardcodes the securitySolution owner, it should not be used for Observability or Elasticsearch cases or anything outside the Security solution space; one noted limitation is that the syncAlerts setting, which links case status to attached alert statuses, is available only for Security cases.