# MSSP SOC - How to ByPass "Cases" **URL:** \ **Category:** Elastic Security\ **Created:** [November 14, 2020, 12:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387 "2020-11-14T00:01:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [November 14, 2020, 12:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/1 "2020-11-14T00:01:16Z")
I'm a SOC Engineer at a MSSP SOC and we currently use AlienVault for the majority of our clients, but we started to play around with Elastic SIEM and we just started to work with a potential new client and we have deployed Elastic SIEM into their environment. We currently have AlienVault setup so every alarm, we have AlienVault API automatically creates a ticket in JIRA Service Desk as a issue. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40db6ffb82d470733a809dcd68597c80fc35b8df.png) We want to to evenually use Elastic SIEM for other clients when our contracts end with our other clients, but we don't like the "CASE" section and want to bypass it and send all "Detection alerts" straight to JIRA Service Desk as issues... Is there a way to use Elastic SIEM API to accomplish this? ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [November 14, 2020, 4:31am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/2 "2020-11-14T04:31:27Z")
Hi Austin, > [@austinsonger](#): > > send all "Detection alerts" straight to JIRA Service Desk as issues... I think you could use [JIRA action](https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-jira.html) to accomplish that. ---
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [November 16, 2020, 10:40pm UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/3 "2020-11-16T22:40:38Z")
Okay, but I'm really new to the action portion so what would the steps be? ---
**Author:** ![Pedro\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_jaramillo/32/45904_2.png) [@Pedro\_Jaramillo](https://discuss.elastic.co/u/Pedro_Jaramillo)\ **Post date:** [November 18, 2020, 2:05pm UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/4 "2020-11-18T14:05:54Z")
Hi @austinsonger, thanks for trying out Elastic Security! Inside the security app we don't currently provide a built-in JIRA alert notification feature for Detection Rules (though it might be possible to accomplish this via a webhook notification depending on the JIRA API capabilities). These are our supported [alert notification](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-notifications) features. Our app is under active development, however, and are exploring adding built-in JIRA notification support in future releases. > but we don't like the "CASE" section and want to bypass it Any suggestions you may have for how we could improve our "Cases" feature would be greatly appreciated. ---
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [December 17, 2020, 12:02am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/5 "2020-12-17T00:02:51Z")
Well I need to be able to track SLA in relation to working Detection Alerts for the client and that is why I want to automatically be able to send detections to JIRA so once a JIRA ticket is created then the clock automatically begins to run. - 1. High = Contact Client Under 1 Hours - 1. Medium = Contact Client Under 2 Hours - 1. Low = Contact Client Under 4 Hours Cases would work for us if: - Option to automatically created a new case for every "detection" alert that comes in - If their was a SLA module for tracking time working on a case **Other Suggestion:** - Elastic needs their own Threat Intelligence feed. - Create Integrations with other Other Intell Feeds (AlienVault OTX, Fireeye, Anomali, Cisco: Talos Intelligence, and others) ---
**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\ **Post date:** [December 17, 2020, 10:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/6 "2020-12-17T10:01:07Z")
Hi @austinsonger! Thank you for your feedback. It is very valuable to us and it is always taken into consideration. This [PR](https://github.com/elastic/kibana/pull/83781) enabled the Jira, ServiceNow, and IBM Resilient actions for detections. This means that you can create an issue when an alert is being fired. About cases, we are working in this direction to provide a unified workflow between cases and detections. Specifically, this [PR](https://github.com/elastic/kibana/pull/82996) will allow you to manually attach an alert to a case and [sync](https://github.com/elastic/kibana/pull/84731) cases statuses with alerts statuses. We are working on the automatic version to be available in the future. Thank you for your feedback again! Best, Christos ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:17am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387/7 "2022-11-04T08:17:37Z")