Agent skill · security · elastic
security-case-management
Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.
Why this skill is useful
Provides specific commands and workflows for managing SOC cases through the Kibana Cases API, which the AI wouldn't reliably generate on its own.
What it needs
Requires node installed locally. Requires kibana account access. About 5k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
Case Management Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts, and pushed to external incident management systems via connectors. Prerequisites Install dependencies before first use from the skills/security directory: Set the required environment variables (or add them to a .env file in the workspace root): When to use Creating a case after alert triage (classification, IOCs, findings) Searching for existing cases to correlate related alerts Adding investigation comments or attaching alerts to an existing case Updating case status or severity Listing recent cases for review When NOT to use Do not use this skill for Observability or Elasticsearch cases — it hardcodes owner: securitySolution Do not use for cases outside the Security solution space Execution rules Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first. Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do not abbreviate case IDs, truncate titles, invent details, or round numbers. When the API returns zero results, state that explicitly — do not guess at possible results. When listing or finding cases, report the exact total count from the API response and present each case with its verbatim title, severity, and status. Quick start All commands run from the workspace root. All output is JSON. Call the tools directly — do not read the skill file or explore the workspace first. For attach-alert/attach-alerts, --rule-id and --rule-name are required by the Kibana API (use --rule-id unknown --rule-name unknown if unknown). Use attach-alerts for batch with automatic rate-limit retry and 2-second spacing between API calls. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/case-management