# Creating external case from Elastic to XSOAR

**URL:** <https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354>\
**Category:** Kibana\
**Created:** [July 11, 2021, 8:09am UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354 "2021-07-11T08:09:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![randomguyneedhelp](https://avatars.discourse-cdn.com/v4/letter/r/e99b99/32.png) [@randomguyneedhelp](https://discuss.elastic.co/u/randomguyneedhelp)\
**Post date:** [July 11, 2021, 8:09am UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354/1 "2021-07-11T08:09:03Z")

</div>

Hi,

I will like to know if there are such integration between Elastic and XSOAR. Understand there are integrations for such functions with ServiceNow, JIRA and IBM Resilient, however I am trying to make use Cortex XSOAR to do case creation from Elastic.

I will like to if we can trigger API from XSOAR when we are creating a case in Elastic.

Thank you!

---

<div class="post-metadata">

**Author:** ![Rachel\_Shen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachel_shen/32/83985_2.png) [@Rachel\_Shen](https://discuss.elastic.co/u/Rachel_Shen)\
**Post date:** [July 12, 2021, 1:35pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354/2 "2021-07-12T13:35:16Z")

</div>

Hello! In an open issue, [Additional action types for alerting · Issue #45023 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/45023), this looks like it's on our roadmap.

I haven't been able to find exactly what you're looking for (case creation from Elastic using Cortex XSOAR) but I wanted to share what I have found.

I found a Palo Alto Networks presentation where they integrated XSOAR with Elastic.  
Presentation: [Upgrade Your SOC with Cortex XSOAR & Elastic SIEM | Elastic](https://www.elastic.co/elasticon/tour/2020/tysons/upgrade-your-soc-with-cortex-xsoar-elastic-siem) slides: [Upgrade Your SOC with Cortex XSOAR & Elastic SIEM](https://www.slideshare.net/elasticsearch/upgrade-your-soc-with-cortex-xsoar-elastic-siem)

It looks like they have some more information on their site that might be helpful:  
[https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/installation/install-cortex-xsoar-with-elasticsearch.html](https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/installation/install-cortex-xsoar-with-elasticsearch.html)  
[https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/manage-data/migrate-indicators-to-elasticsearch/indicator-migration-overview.html](https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/manage-data/migrate-indicators-to-elasticsearch/indicator-migration-overview.html)

Thanks!

---

<div class="post-metadata">

**Author:** ![randomguyneedhelp](https://avatars.discourse-cdn.com/v4/letter/r/e99b99/32.png) [@randomguyneedhelp](https://discuss.elastic.co/u/randomguyneedhelp)\
**Post date:** [July 12, 2021, 4:21pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354/3 "2021-07-12T16:21:34Z")

</div>

Hi Rachel,

Thanks for the reply!

What I am looking for it, is to try to trigger XSOAR's incident creation when Elastic has a new Case created.

May I know if this is possible?

Many thanks!

---

<div class="post-metadata">

**Author:** ![Rachel\_Shen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachel_shen/32/83985_2.png) [@Rachel\_Shen](https://discuss.elastic.co/u/Rachel_Shen)\
**Post date:** [July 14, 2021, 6:53pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354/4 "2021-07-14T18:53:21Z")

</div>

Hi!

Unfortunately, it does not look like this is yet possible. Please check out the public issue for when better integration is possible! [Additional action types for alerting · Issue #45023 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/45023).

Best,  
Rachel

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2021, 6:53pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354/5 "2021-08-11T18:53:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.