explainx.ainewsletter3.4k
Productivity

security-case-management▌

elastic/agent-skills · updated Apr 8, 2026

MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.

$npx skills add https://github.com/elastic/agent-skills --skill security-case-management
0 commentsdiscussion
summary

Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates

  • ›exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,
  • ›and pushed to external incident management systems via connectors.
skill.md

Case Management

Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts, and pushed to external incident management systems via connectors.

Prerequisites

Install dependencies before first use from the skills/security directory:

cd skills/security && npm install

Set the required environment variables (or add them to a .env file in the workspace root):

export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"

When to use

  • Creating a case after alert triage (classification, IOCs, findings)
  • Searching for existing cases to correlate related alerts
  • Adding investigation comments or attaching alerts to an existing case
  • Updating case status or severity
  • Listing recent cases for review

When NOT to use

  • Do not use this skill for Observability or Elasticsearch cases — it hardcodes owner: securitySolution
  • Do not use for cases outside the Security solution space

Execution rules

  • Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.
  • Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do not abbreviate case IDs, truncate titles, invent details, or round numbers.
  • When the API returns zero results, state that explicitly — do not guess at possible results.
  • When listing or finding cases, report the exact total count from the API response and present each case with its verbatim title, severity, and status.

Quick start

All commands run from the workspace root. All output is JSON. Call the tools directly — do not read the skill file or explore the workspace first. For attach-alert/attach-alerts, --rule-id and --rule-name are required by the Kibana API (use --rule-id unknown --rule-name unknown if unknown). Use attach-alerts for batch with automatic rate-limit retry and 2-second spacing between API calls.

Common multi-step workflows

Task Tools to call (in order)
Create a case case_manager create (title, description, tags, severity)
Find cases for a host case_manager find --tags "agent_id:<id>" or find --search "<hostname>"
Attach alert to case case_manager attach-alert (case-id, alert-id, alert-index, rule-id/name)
Add investigation notes case_manager add-comment (case-id, comment text)
List recent open cases case_manager list --status open --per-page <n>
Update case case_manager update (case-id, status/severity/tags changes)

Finding cases for a host: Use find --search "<hostname>" to search by hostname across title, description, and comments. Alternatively use find --tags "agent_id:<agent_id>" if the agent ID is known. Always add --status open to filter to active cases only. Report the exact total count and each case title verbatim from the API response.

# Create (syncAlerts enabled by default; disable with --sync-alerts false)
node skills/security/case-management/scripts/case-manager.js create --title "Malicious DLL sideloading on host1" --description "Crypto clipper malware detected via DLL sideloading..." --tags "classification:malicious" "confidence:88" "mitre:T1574.002" --severity critical --yes

# Find, list, get
node skills/security/case-management/scripts/case-manager.js find --tags "agent_id:550888e5-357d-4bc1-a154-486eb7b4e076"
node skills/security/case-management/scripts/case-manager.js find --search "DLL sideloading" --status open
node skills/security/case-management/scripts/case-manager.js list --status open --per-page 10
node skills/security/case-management/scripts/case-manager.js get --case-id <case_id>

# Attach single alert
node skills/security/case-management/scripts/case-manager.js attach-alert --case-id <case_id> --alert-id <alert_doc_id> --alert-index .ds-.alerts-security.alerts-default-2025.12.01-000013 --rule-id <rule_uuid> --rule-name "Malware Detection Alert"

# Attach multiple alerts (batch)
node skills/security/case-management/scripts/case-manager.js attach-alerts --case-id <case_id> --alert-ids <id1> <id2> <id3> --alert-index .ds-.alerts-security.alerts-default-2026.02.16-000016 --rule-id <rule_uuid> --rule-name "Malware Detection Alert"

# Add comment, update (--tags merges with existing tags, does not replace)
node skills/security/case-management/scripts/case-manager.js add-comment --case-id <case_id> --comment "Process tree analysis shows..."
node skills/security/case-management/scripts/case-manager.js update --case-id <case_id> --status closed --severity low --yes

Write operations (create, update) prompt for confirmation by default. Pass --yes to skip the prompt (required when called by an agent).

Reporting list and find results

When reporting results from list or find:

  1. State the exact total count from the JSON response (e.g., "There are 12 open cases total").
  2. Present each case as a compact one-line entry: <title> | <severity> | <case_id_short> | <created_at>. Copy the exact title verbatim from the title field — do not rephrase, abbreviate, or summarize.
  3. If the user asked for N cases, present exactly N entries (or fewer if fewer exist). Do not add extra columns (alerts count, description, status) unless the user specifically requested them.
  4. Do not add information beyond what the API returned. If a field is null or missing, omit it.
  5. After presenting the results, stop. Do not add analysis, commentary, or observations about the cases.

Tag conventions

Use structured tags for machine-searchable metadata:

Tag pattern Example Purpose
classification:<value> classification:malicious Triage classification (benign/unknown/malicious)
confidence:<score> confidence:85 Confidence score 0-100
mitre:<technique> mitre:T1574.002 MITRE ATT&CK technique IDs
agent_id:<id> agent_id:550888e5-... Elastic agent ID for correlation
rule:<name> rule:Malicious Behavior Detection Detection rule name

Case severity mapping

Classification Kibana severity
benign (score 0-19) low
unknown (score 20-60) medium
malicious (score 61-80) high
malicious (score 81-100) critical

Known limitations

syncAlerts is security-only

The syncAlerts setting (enabled by default) synchronizes case status with attached alert statuses. This feature is only available for Security Solution cases. Pass --sync-alerts false when creating a case if alert sync is not needed.

Rate limiting

The Kibana API enforces rate limits. When attaching multiple alerts, the attach-alerts batch command automatically handles 429 responses with retry. If using attach-alert one at a time, space calls ~10 seconds apart.

find --search on Serverless

The find --search parameter may return 500 errors on Kibana Serverless deployments. Use find --tags for filtering instead, or list to browse recent cases.

find --tags requires exact match

Tag searches are exact-match only. find --tags "agent_id:abc123" works, but partial matches do not.

Kibana Cases API reference

For detailed API endpoints, request/response formats, and examples, see references/kibana-cases-api.md.

Examples

  • "Create a case for the phishing alert I triaged with severity high"
  • "Search for open cases related to brute force attacks"
  • "Add the investigation findings as a comment to case ID abc-123"

Guidelines

  • Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.
  • Preserve identifiers from the request — use exact values the user provides in tool calls and responses.
  • Confirm actions concisely using the tool's return data.
  • Distinguish facts from inference — label conclusions beyond tool output as your assessment.
  • When presenting case lists or search results, copy the exact title from each case. Do not paraphrase, abbreviate, or summarize titles. Include the total count from the API total field.
  • Start executing tools immediately. Do not read SKILL.md, browse directories, or list files before acting.

Production use

  • Write operations (create, update) prompt for confirmation. Pass --yes or -y to skip when called by an agent.
  • Verify KIBANA_URL and KIBANA_API_KEY point to the intended cluster before running any command.
  • Cases are scoped to securitySolution — this skill does not affect Observability or other Kibana case owners.

Environment variables

Variable Required Description
KIBANA_URL Yes Kibana base URL (e.g., https://my-kibana.kb.cloud.example.com)
KIBANA_API_KEY Yes Kibana API key for authentication
how to use security-case-management

How to use security-case-management on Cursor

AI-first code editor with Composer

1

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

  • ›Cursor installed and configured on your development machine
  • ›Node.js version 16.0+ with npm package manager (verify with node --version)
  • ›Active project directory or workspace where you want to add security-case-management
2

Execute installation command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills add https://github.com/elastic/agent-skills --skill security-case-management

The skills CLI fetches security-case-management from GitHub repository elastic/agent-skills and configures it for Cursor.

3

Select Cursor when prompted

The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:

◆ Which agents do you want to install to?
│
│ ── Universal (.agents/skills) ── always included ────
│ • Amp
│ • Antigravity
│ • Cline
│ • Codex
│ ●Cursor(selected)
│ • Cursor
│ • Windsurf
4

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/security-case-management

Reload or restart Cursor to activate security-case-management. Access the skill through slash commands (e.g., /security-case-management) or your agent's skill management interface.

⚠

Security & Verification Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.

Additional Resources

›View source code on GitHub›Skills CLI documentation›Learn more about Cursor›What are agent skills?

List & Monetize Your Skill

Submit your Claude Code skill and start earning

GET_STARTED →

Use Cases▌

User Story & Requirements Generation

Create detailed user stories, acceptance criteria, and feature specs

Example

Generate user stories for 'password reset feature' with acceptance criteria, edge cases, and test scenarios

✓

Reduce spec writing time by 50%, ensure comprehensive coverage

Competitive Analysis

Research competitors, compare features, identify gaps

Example

Analyze 5 competitor products, create feature comparison matrix, suggest differentiation opportunities

✓

Complete competitive research in 2 hours instead of 2 days

Roadmap Prioritization

Evaluate features using frameworks (RICE, ICE, Kano) and create prioritized backlogs

Example

Score 20 feature ideas using RICE framework, generate prioritized roadmap with rationale

✓

Make data-driven prioritization decisions faster

Stakeholder Communication

Draft PRDs, status updates, and stakeholder presentations

Example

Create executive summary of Q3 roadmap, monthly progress report, feature launch announcement

✓

Save 3-5 hours/week on communication overhead

Implementation Guide▌

Prerequisites

  • ›Claude Desktop or compatible AI client
  • ›Access to product documentation and roadmap tools (Jira, Notion, etc.)
  • ›Understanding of product management frameworks (RICE, Jobs-to-be-Done, etc.)
  • ›Stakeholder contact information and communication channels

Time Estimate

30-60 minutes to see productivity improvements

Installation Steps

  1. 1.Install product management skill
  2. 2.Start with user story generation for known feature
  3. 3.Progress to competitive analysis: research 2-3 competitors
  4. 4.Use for roadmap prioritization: apply RICE/ICE scoring
  5. 5.Draft stakeholder communications and refine based on feedback
  6. 6.Build template library for recurring PM tasks
  7. 7.Share effective prompts with product team

Common Pitfalls

  • ⚠Not validating competitive research—verify facts before sharing
  • ⚠Accepting user stories without involving engineering team
  • ⚠Over-relying on frameworks without qualitative judgment
  • ⚠Not customizing outputs to company culture and communication style
  • ⚠Skipping stakeholder validation of generated requirements

Best Practices▌

✓ Do

  • +Validate research and competitive analysis with real data
  • +Collaborate with engineering when generating technical requirements
  • +Customize frameworks and templates to your company context
  • +Use skill for first drafts, refine with stakeholder input
  • +Document successful prompt patterns for PM tasks
  • +Combine AI efficiency with human judgment and intuition

✗ Don't

  • −Don't publish competitive analysis without fact-checking
  • −Don't finalize user stories without engineering review
  • −Don't make prioritization decisions solely on AI scoring
  • −Don't skip customer validation of generated requirements
  • −Don't ignore company-specific context and culture

💡 Pro Tips

  • ★Provide context: company goals, constraints, customer feedback
  • ★Ask for alternatives: 'Show 3 ways to prioritize this roadmap'
  • ★Request stakeholder-specific formatting: 'Executive summary vs. engineering spec'
  • ★Use skill for 70% generation + 30% customization to company needs

When to Use This▌

✓ Use When

Use for user story writing, competitive research, roadmap prioritization, stakeholder communication, and PRD drafting. Best for reducing repetitive documentation and research work.

✗ Avoid When

Avoid for strategic product vision (requires deep customer empathy), pricing decisions (needs market and financial expertise), or when face-to-face customer discovery is more valuable than speed.

Learning Path▌

  1. 1Basic: user stories, feature specs, status updates
  2. 2Intermediate: competitive analysis, prioritization frameworks, PRDs
  3. 3Advanced: product strategy, go-to-market planning, OKR setting
  4. 4Expert: product vision, market positioning, business model innovation

Discussion

Product Hunt–style comments (not star reviews)
  • No comments yet — start the thread.
general reviews

Ratings

4.5★★★★★25 reviews
  • ★★★★★Carlos Lopez· Nov 7, 2024

    Registry listing for security-case-management matched our evaluation — installs cleanly and behaves as described in the markdown.

  • ★★★★★Kiara Martin· Oct 26, 2024

    Keeps context tight: security-case-management is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • ★★★★★Ava Mensah· Sep 13, 2024

    Useful defaults in security-case-management — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.

  • ★★★★★Yash Thakker· Sep 5, 2024

    Solid pick for teams standardizing on skills: security-case-management is focused, and the summary matches what you get after install.

  • ★★★★★Rahul Santra· Sep 1, 2024

    Keeps context tight: security-case-management is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • ★★★★★Kaira Liu· Sep 1, 2024

    security-case-management is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.

  • ★★★★★Dhruvi Jain· Aug 24, 2024

    We added security-case-management from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.

  • ★★★★★Pratham Ware· Aug 20, 2024

    Registry listing for security-case-management matched our evaluation — installs cleanly and behaves as described in the markdown.

  • ★★★★★Sofia Gonzalez· Aug 20, 2024

    security-case-management fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.

  • ★★★★★Carlos Sharma· Aug 4, 2024

    security-case-management has been reliable in day-to-day use. Documentation quality is above average for community skills.

showing 1-10 of 25

1 / 3