Security Case Management

If you're running Elastic Security and need to manage SOC cases programmatically, this handles the full lifecycle through Kibana's Cases API. Create cases after alert triage, search by hostname or agent ID, attach alerts in batches, add investigation notes, update severity and status. It's hardcoded to securitySolution owner, so don't try using it for Observability cases. The execution rules are refreshingly blunt: start immediately, report API output verbatim, don't invent details or round numbers. Includes multi-step workflow examples like "find cases for a host" and batch alert attachment with automatic rate limiting. Requires Node.js 22+ and either API key or username/password auth to your Kibana instance.

Install to Claude Code

npx -y skills add elastic/agent-skills --skill security-case-management --agent claude-code