# Security Case Management

**URL:** <https://discuss.elastic.co/t/security-case-management/134101>\
**Category:** Kibana\
**Created:** [May 31, 2018, 7:31pm UTC](https://discuss.elastic.co/t/security-case-management/134101 "2018-05-31T19:31:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stiltz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stiltz/32/39714_2.png) [@stiltz](https://discuss.elastic.co/u/stiltz)\
**Post date:** [May 31, 2018, 7:31pm UTC](https://discuss.elastic.co/t/security-case-management/134101/1 "2018-05-31T19:31:07Z")

</div>

Has anyone thought about building a cyber security case management solution on top of the ELK stack?  
I can imagine a streamlined workflow for cyber security analysts/incident response teams. Analysts on a "hunt" could mark a record or records as the start of a new case and then could add additional records to that case. When adding records to a case it could potential prevent those records from being curated off the cluster or delay curation based on some criteria. This could also enable enrichment and correlation of case artifacts (IPs, hostnames, IOCs, etc...) more quickly or automatically and allowing analysts to operate within a single platform instead of moving between platforms frequently.

The only platform I've seen that achieves something like this is Apache Metron. I'd rather leverage an existing investment in the Elasticstack if possible which has the data I'm interested in using for case generation and enrichment.

Thanks for your input/ideas in advance.  
Darren

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 31, 2018, 10:37pm UTC](https://discuss.elastic.co/t/security-case-management/134101/2 "2018-05-31T22:37:16Z")

</div>

There's a few tools out there that do some of this.  
CAPESStack and NightHawk are two that come to mind.

> [@stiltz](#):
>
> Apache Metron

That is (or was until recently) built on Elasticsearch.

---

<div class="post-metadata">

**Author:** ![stiltz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stiltz/32/39714_2.png) [@stiltz](https://discuss.elastic.co/u/stiltz)\
**Post date:** [June 1, 2018, 3:18pm UTC](https://discuss.elastic.co/t/security-case-management/134101/3 "2018-06-01T15:18:03Z")

</div>

Thanks for the feedback. Apache Metron still uses Elasticsearch on the backend. I'm also looking at TheHive Project.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2018, 3:18pm UTC](https://discuss.elastic.co/t/security-case-management/134101/4 "2018-06-29T15:18:17Z")

</div>

Closed on June 29, 2018, 3:18pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.