Cases feature in Kibana

I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this through the timeline I created. There is however an option on the top right to add it to a case but I don't want the whole timeline in the case only a certain error.
would be great if anyone could help me out please.

Hi @cctk ,

You can attach an event to a case from the timeline if the kind of event is signal. At the moment you cannot attach events of another kind.

Attaching an alert to cases from detections page:

Unsupported event cannot be attached to a case:

Let me know if you need any help!


Thank you for your help!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.