Hi,
I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this through the timeline I created. There is however an option on the top right to add it to a case but I don't want the whole timeline in the case only a certain error.
would be great if anyone could help me out please.
Hi @cctk ,
You can attach an event to a case from the timeline if the kind of event is signal. At the moment you cannot attach events of another kind.
Attaching an alert to cases from detections page:
Unsupported event cannot be attached to a case:
Let me know if you need any help!
Best,
Christos
Thank you for your help!