Cases feature in Kibana

Hi,
I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this through the timeline I created. There is however an option on the top right to add it to a case but I don't want the whole timeline in the case only a certain error.
would be great if anyone could help me out please.

Hi @cctk ,

You can attach an event to a case from the timeline if the kind of event is signal. At the moment you cannot attach events of another kind.

Attaching an alert to cases from detections page:

Unsupported event cannot be attached to a case:

Let me know if you need any help!

Best,
Christos

Thank you for your help!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.