# Optimizing Incident Triaging via Kibana Case Integration

**URL:** https://discuss.elastic.co/t/optimizing-incident-triaging-via-kibana-case-integration/387480
**Category:** Elastic Security
**Created:** [July 2, 2026, 3:03pm UTC](https://discuss.elastic.co/t/optimizing-incident-triaging-via-kibana-case-integration/387480 "2026-07-02T15:03:22Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![reports](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reports/32/147784_2.png) [@reports](https://discuss.elastic.co/u/reports)
#### Post date: [July 2, 2026, 3:03pm UTC](https://discuss.elastic.co/t/optimizing-incident-triaging-via-kibana-case-integration/387480/1 "2026-07-02T15:03:22Z")

</div>

I have created security rules in Kibana and integrated the **Cases** action to enable auto-generated cases. Initially, I faced a limitation where I couldn't customize the case payload to extract critical alert details. This made it difficult to immediately identify what was wrong with a specific host or determine the correct team assignment.