# Creating cases from signals
**URL:** https://discuss.elastic.co/t/creating-cases-from-signals/238315
**Category:** SIEM
**Created:** [June 23, 2020, 5:17pm UTC](https://discuss.elastic.co/t/creating-cases-from-signals/238315 "2020-06-23T17:17:01Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@forkhead](https://discuss.elastic.co/u/forkhead)
#### Post date: [June 23, 2020, 5:17pm UTC](https://discuss.elastic.co/t/creating-cases-from-signals/238315/1 "2020-06-23T17:17:01Z")
Hi, I am trying to understand a couple of things with Detections and Cases in Elastic SIEM -
1. Is there a way to automatically create cases for some rule detections ?
2. Is there a way to store or create Case Templates in Cases (which then can also be attached to some detections where we want an automatic creation of a case) ?
Thanks
---
### Author:  [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)
#### Post date: [June 23, 2020, 9:13pm UTC](https://discuss.elastic.co/t/creating-cases-from-signals/238315/2 "2020-06-23T21:13:55Z")
Hi again @forkhead, thanks for the continued interest!
> 1. Is there a way to automatically create cases for some rule detections ?
No, there is not currently an in-app method for automatically creating a case as a rule action. This is something that we are investigating for a future release. We have heard this request from MSSP-type users, who have a SLA in place that requires them to auto-create case upon certain detections.
> 1. Is there a way to store or create Case Templates in Cases (which then can also be attached to some detections where we want an automatic creation of a case) ?
No, there is not currently a way to do this in the SIEM app. This too is an area of investigation for future capabilities. As a partial workaround, one idea is to include the case template in the rule's advanced setting "Investigation guide." When a signal detected by the rule is investigated in the Timeline, the "Investigation guide" text is automatically populated in the Timeline Notes. When creating a case from the Timeline, the analyst can first copy the text from the Timeline Note, and then paste it into the newly opened case.
Please keep the feedback coming!
---
### Author:  [@forkhead](https://discuss.elastic.co/u/forkhead)
#### Post date: [June 23, 2020, 9:43pm UTC](https://discuss.elastic.co/t/creating-cases-from-signals/238315/3 "2020-06-23T21:43:48Z")
Haha @Mike_Paquette thanks for the replies. Yes, I was thinking if there is an in-app way to create cases where we always want those detections to be investigated but I think the other option I see is basically using the Signals API to fetch those and Cases API to create the case. For the other question let me look into the "Investigation guide" functionality.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2020, 9:43pm UTC](https://discuss.elastic.co/t/creating-cases-from-signals/238315/4 "2020-07-21T21:43:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.