security-case-management — Skills

What it does

Creating a case after alert triage (classification, IOCs, findings)

Searching for existing cases to correlate related alerts

Adding investigation comments or attaching alerts to an existing case

Updating case status or severity

Listing recent cases for review

Do not use this skill for Observability or Elasticsearch cases — it hardcodes owner: securitySolution

Do not use for cases outside the Security solution space

security case management

Source

Repository: https://github.com/elastic/agent-skills

security-case-management FAQ

What does the security-case-management skill do?

> Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output. Creating a case after alert triage (classification, IOCs, findings) Searching for existing cases to correlate related alerts

What does security-case-management require?

find --tags requires exact match | KIBANAAPIKEY | Yes | Kibana API key for authentication | Configuration keys: KIBANA_URL, KIBANA_API_KEY.

How do I install security-case-management?

Run: npx -y skills add https://github.com/elastic/agent-skills --skill security-case-management --agent claude-code — the source lives at github.com/elastic/agent-skills.

Maintain security-case-management?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[security-case-management on getagentictools](https://getagentictools.com/skills/elastic-agent-skills-security-case-management?ref=badge)

npx agentictools info skills/elastic-agent-skills-security-case-management

The second line is the CLI lookup for this page — handy in READMEs and docs.