Creating a case for an alert automatically

Elastic Security SIEM
1

Hey Everyone,

Can anyone please tell if there's a way to create a case for an alert automatically. So that we dont have to do it manually.

Thanks

2

Hi @subham No, there is not currently a simple way to create a case automatically when an alert is created. This is a capability we are looking into for potential future implementation.

Would you mind telling us a bit more about how you would use such a capability.

  • Would it be for a single alert?
  • Would you want to aggregate (group) alerts together into a case? If so, how might you group them?
  • Would you want the ability to add to an existing alert (for example, if a similar alert caused a case to be created recently?)

Thank you,
Mike P.

3

Theoretically you can use the "actions" with a webhook to create a case using the cases api.
How well this suits you depends on your requirements.