Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/elastic/agent-skills --skill security-case-management- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads security-case-management automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Case Management
Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates
exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,
and pushed to external incident management systems via connectors.
Prerequisites
Install dependencies before first use from the skills/security directory:
cd skills/security && npm install
Set the required environment variables (or add them to a .env file in the workspace root):
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
When to use
- Creating a case after alert triage (classification, IOCs, findings)
- Searching for existing cases to correlate related alerts
- Adding investigation comments or attaching alerts to an existing case
- Updating case status or severity
- Listing recent cases for review
When NOT to use
- Do not use this skill for Observability or Elasticsearch cases — it hardcodes
owner: securitySolution - Do not use for cases outside the Security solution space
Execution rules
- Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.
- Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do not abbreviate case IDs, truncate titles, invent details, or round numbers.
- When the API returns zero results, state that explicitly — do not guess at possible results.
- When listing or finding cases, report the exact total count from the API response and present each case with its verbatim title, severity, and status.
Quick start
All commands run from the workspace root. All output is JSON. Call the tools directly — do not read the skill file or
explore the workspace first. For attach-alert/attach-alerts, --rule-id and --rule-name are required by the Kibana
API (use --rule-id unknown --rule-name unknown if unknown). Use attach-alerts for batch with automatic rate-limit
retry and 2-second spacing between API calls.
Common multi-step workflows
| Task | Tools to call (in order) |
|---|---|
| Create a case | case_manager create (title, description, tags, severity) |
| Find cases for a host | case_manager find --tags "agent_id:<id>" or find --search "<hostname>" |
| Attach alert to case | case_manager attach-alert (case-id, alert-id, alert-index, rule-id/name) |
| Add investigation notes | case_manager add-comment (case-id, comment text) |
| List recent open cases | case_manager list --status open --per-page <n> |
| Update case | case_manager update (case-id, status/severity/tags changes) |
Finding cases for a host: Use find --search "<hostname>" to search by hostname across title, description, and
comments. Alternatively use find --tags "agent_id:<agent_id>" if the agent ID is known. Always add --status open to
filter to active cases only. Report the exact total count and each case title verbatim from the API response.
# Create (syncAlerts enabled by default; disable with --sync-alerts false)
node skills/security/case-management/scripts/case-manager.js create --title "Malicious DLL sideloading on host1" --description "Crypto clipper malware detected via DLL sideloading..." --tags "classification:malicious" "confidence:88" "mitre:T1574.002" --severity critical --yes
# Find, list, get
node skills/security/case-management/scripts/case-manager.js find --tags "agent_id:550888e5-357d-4bc1-a154-486eb7b4e076"
node skills/security/case-management/scripts/case-manager.js find --search "DLL sideloading" --status open
node skills/security/case-management/scripts/case-manager.js list --status open --per-page 10
node skills/security/case-management/scripts/case-manager.js get --case-id <case_id>
# Attach single alert
node skills/security/case-management/scripts/case-manager.js attach-alert --case-id <case_id> --alert-id <alert_doc_id> --alert-index .ds-.alerts-security.alerts-default-2025.12.01-000013 --rule-id <rule_uuid> --rule-name "Malware Detection Alert"
# Attach multiple alerts (batch)
node skills/security/case-management/scripts/case-manager.js attach-alerts --case-id <case_id> --alert-ids <id1> <id2> <id3> --alert-index .ds-.alerts-security.alerts-default-2026.02.16-000016 --rule-id <rule_uuid> --rule-name "Malware Detection Alert"
# Add comment, update (--tags merges with existing tags, does not replace)
node skills/security/case-management/scripts/case-manager.js add-comment --case-id <case_id> --comment "Process tree analysis shows..."
node skills/security/case-management/scripts/case-manager.js update --case-id <case_id> --status closed --severity low --yes
Write operations (create, update) prompt for confirmation by default. Pass --yes to skip the prompt (required when
called by an agent).
Reporting list and find results
When reporting results from list or find:
- State the exact
totalcount from the JSON response (e.g., "There are 12 open cases total"). - Present each case as a compact one-line entry:
<title> | <severity> | <case_id_short> | <created_at>. Copy the exact title verbatim from thetitlefield — do not rephrase, abbreviate, or summarize. - If the user asked for N cases, present exactly N entries (or fewer if fewer exist). Do not add extra columns (alerts count, description, status) unless the user specifically requested them.
- Do not add information beyond what the API returned. If a field is null or missing, omit it.
- After presenting the results, stop. Do not add analysis, commentary, or observations about the cases.
Tag conventions
Use structured tags for machine-searchable metadata:
| Tag pattern | Example | Purpose |
|---|---|---|
classification:<value> | classification:malicious | Triage classification (benign/unknown/malicious) |
confidence:<score> | confidence:85 | Confidence score 0-100 |
mitre:<technique> | mitre:T1574.002 | MITRE ATT&CK technique IDs |
agent_id:<id> | agent_id:550888e5-... | Elastic agent ID for correlation |
rule:<name> | rule:Malicious Behavior Detection | Detection rule name |
Case severity mapping
| Classification | Kibana severity |
|---|---|
| benign (score 0-19) | low |
| unknown (score 20-60) | medium |
| malicious (score 61-80) | high |
| malicious (score 81-100) | critical |
Known limitations
syncAlerts is security-only
The syncAlerts setting (enabled by default) synchronizes case status with attached alert statuses. This feature is
only available for Security Solution cases. Pass --sync-alerts false when creating a case if alert sync is not needed.
Rate limiting
The Kibana API enforces rate limits. When attaching multiple alerts, the attach-alerts batch command automatically
handles 429 responses with retry. If using attach-alert one at a time, space calls ~10 seconds apart.
find --search on Serverless
The find --search parameter may return 500 errors on Kibana Serverless deployments. Use find --tags for filtering
instead, or list to browse recent cases.
find --tags requires exact match
Tag searches are exact-match only. find --tags "agent_id:abc123" works, but partial matches do not.
Kibana Cases API reference
For detailed API endpoints, request/response formats, and examples, see references/kibana-cases-api.md.
Examples
- "Create a case for the phishing alert I triaged with severity high"
- "Search for open cases related to brute force attacks"
- "Add the investigation findings as a comment to case ID abc-123"
Guidelines
- Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.
- Preserve identifiers from the request — use exact values the user provides in tool calls and responses.
- Confirm actions concisely using the tool's return data.
- Distinguish facts from inference — label conclusions beyond tool output as your assessment.
- When presenting case lists or search results, copy the exact title from each case. Do not paraphrase, abbreviate,
or summarize titles. Include the total count from the API
totalfield. - Start executing tools immediately. Do not read SKILL.md, browse directories, or list files before acting.
Production use
- Write operations (
create,update) prompt for confirmation. Pass--yesor-yto skip when called by an agent. - Verify
KIBANA_URLandKIBANA_API_KEYpoint to the intended cluster before running any command. - Cases are scoped to
securitySolution— this skill does not affect Observability or other Kibana case owners.
Environment variables
| Variable | Required | Description |
|---|---|---|
KIBANA_URL | Yes | Kibana base URL (e.g., https://my-kibana.kb.cloud.example.com) |
KIBANA_API_KEY | Yes | Kibana API key for authentication |
FAQ
What does the security-case-management skill do?
Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.
How do I install security-case-management?
Run npx skills add https://github.com/elastic/agent-skills --skill security-case-management in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-case-management/ (personal) or .claude/skills/security-case-management/ (project).
Which AI agents can use security-case-management?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is security-case-management safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk flagged items to review; Runlayer flagged risks. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains security-case-management?
It is published by elastic in elastic/agent-skills. It has 4,135 recorded installs.
More from elastic/agent-skills
elasticsearch-esql
elastic/agent-skills
Execute ESQL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ESQL results.
elasticsearch-onboarding
elastic/agent-skills
Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started with Elasticsearch.
kibana-dashboards
elastic/agent-skills
Create and manage Kibana Dashboards and Lens visualizations. Use when you need to define dashboards and visualizations declaratively, version control them, or automate their deployment.
kibana-alerting-rules
elastic/agent-skills
Create and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.
kibana-agent-builder
elastic/agent-skills
Create and manage Kibana Agent Builder agents and custom tools. Use when asked to create, update, delete, test, or inspect agents or tools in Agent Builder, or when the user wants to understand what agents or tools already exist.
observability-llm-obs
elastic/agent-skills
Answer questions about LLM and agentic-application behavior from data already ingested into Elastic: latency and error rate, token and cost utilization, response quality and guardrail events, and agentic call-chain orchestration. Use when the user asks about LLM monitoring, GenAI observability, token spend or AI cost, model latency, prompt or guardrail failures, or how an agent's tool-call chain executed.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.