Security Case Management

Create cases after alert triage, search by hostname or agent ID, attach alerts in batches, add investigation notes, update severity and status. It's hardcoded to securitySolution owner, so don't try using it for Observability cases. The execution rules are refreshingly blunt: start immediately, report API output verbatim, don't invent details or round numbers. Includes multi-step workflow examples like "find cases for a host" and batch alert attachment with automatic rate limiting. Requires Node.js 22+ and either API key or username/password auth to your Kibana instance.