# Create Cases with Elastic Security Rule Alerts

**URL:** https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067
**Category:** Endpoint Security
**Tags:** detection-rules
**Created:** [January 10, 2025, 2:39pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067 "2025-01-10T14:39:30Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![logalicious](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@logalicious](https://discuss.elastic.co/u/logalicious)
#### Post date: [January 10, 2025, 2:39pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067/1 "2025-01-10T14:39:30Z")

</div>

Is there a way to create cases automatically when specific Security Rules trigger? I see lots of integrations for third-party case management tools, but I do not see any way to integrate security rules with Elastic Cases.

Has anyone integrated Elastic Security Rules and Cases in any form? Is this possible?

Also, if you have any good experiences with third-party case management tools, I would be interested in hearing which works best for you. I see options like Torq and Tines that look interesting and specifically designed for a security use.

---

<div class="post-metadata">

### Author: ![Chris\_Owens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_owens/32/57329_2.png) [@Chris\_Owens](https://discuss.elastic.co/u/Chris_Owens)
#### Post date: [January 10, 2025, 3:24pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067/2 "2025-01-10T15:24:48Z")

</div>

Hello, thank you for your question. Yes, when you add a rule action you will see a 'Cases' connector. This will automatically open a case when the rule fires. You can read about it here: [Cases connector and action | Kibana Guide [8.17] | Elastic](https://www.elastic.co/guide/en/kibana/8.17/cases-action-type.html)

Quick note. This feature was introduced in 8.16 in Elastic Security in 'Technical Preview'. The documentation page shows it is still in Technical Preview, but it was actually fully released as of 8.17. We will update the docs.

---

<div class="post-metadata">

### Author: ![logalicious](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@logalicious](https://discuss.elastic.co/u/logalicious)
#### Post date: [January 27, 2025, 1:14pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067/3 "2025-01-27T13:14:19Z")

</div>

Thanks Chris, it is great to know this feature is available in the most recent version of Kibana!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 24, 2025, 1:14pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067/4 "2025-02-24T13:14:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
