# Creating a case for an alert automatically

**URL:** https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686
**Category:** SIEM
**Created:** [January 18, 2022, 11:05am UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686 "2022-01-18T11:05:40Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![subham](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@subham](https://discuss.elastic.co/u/subham)
#### Post date: [January 18, 2022, 11:05am UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686/1 "2022-01-18T11:05:40Z")

</div>

Hey Everyone,

Can anyone please tell if there's a way to create a case for an alert automatically. So that we dont have to do it manually.

Thanks

---

<div class="post-metadata">

### Author: ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)
#### Post date: [January 24, 2022, 1:53pm UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686/2 "2022-01-24T13:53:31Z")

</div>

Hi @subham No, there is not currently a simple way to create a case automatically when an alert is created. This is a capability we are looking into for potential future implementation.

Would you mind telling us a bit more about how you would use such a capability.

- Would it be for a single alert?
- Would you want to aggregate (group) alerts together into a case? If so, how might you group them?
- Would you want the ability to add to an existing alert (for example, if a similar alert caused a case to be created recently?)

Thank you,  
Mike P.

---

<div class="post-metadata">

### Author: ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)
#### Post date: [January 27, 2022, 11:52am UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686/3 "2022-01-27T11:52:25Z")

</div>

Theoretically you can use the "actions" with a webhook to create a case using the cases api.  
How well this suits you depends on your requirements.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 24, 2022, 11:52am UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686/4 "2022-02-24T11:52:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
