# Send security cases to Slack

**URL:** <https://discuss.elastic.co/t/send-security-cases-to-slack/301207>\
**Category:** Elastic Security\
**Created:** [March 31, 2022, 2:12pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207 "2022-03-31T14:12:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![samuelD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samueld/32/103770_2.png) [@samuelD](https://discuss.elastic.co/u/samuelD)\
**Post date:** [March 31, 2022, 2:12pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/1 "2022-03-31T14:12:40Z")

</div>

Hello,

I have an automatic system that creates security cases in my Elastic stack using the [Kibana Endpoint](https://www.elastic.co/guide/en/security/current/cases-api-overview.html). This part is working perfectly.

Once an alert is created, I would like to automatically send a message on a Slack channel to inform the team that a new case has been created.  
I didn't find any information on the Internet on how to accomplish that, so I created an Elastalert query for this but it doesn't work really well (My query is probably not really accurate, but I guess this is not the purpose of this forum to discuss Elastalert?).

Isn't there any integrated feature in Elastic allowing the creation of Slack alerts for cases? The external connectors don't include a Slack connector.

My Elastic stack:  
Cloud-managed Elastic 7.16.2 with Gold license

Kind regards

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 2, 2022, 2:01am UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/2 "2022-04-02T02:01:57Z")

</div>

Hi @samuelD Welcome to the community.

Yes there is:

> **[Elastic Cloud Feature Matrix](https://www.elastic.co/subscriptions/cloud)**
>
> Elastic Cloud gives you the flexibility to run where you want. Deploy our managed service on Google Cloud, Microsoft Azure, or Amazon Web Services, and we'll handle the maintenance and upkeep for you. Start with a free 14-day trial and flexibility to...

Kibana Actions: email, webhooks, Jira, Microsoft Teams, PagerDuty, Slack, Swimlane

> **[Connectors | Kibana Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/kibana/7.16/action-types.html)**
>
> Kibana provides you with several options to share \*Discover\* saved searches, dashboards, \*Visualize Library\* visualizations, and \*Canvas\* workpads with others, or on a website.

> **[Slack connector and action | Kibana Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/kibana/7.16/slack-action-type.html)**
>
> Kibana provides you with several options to share \*Discover\* saved searches, dashboards, \*Visualize Library\* visualizations, and \*Canvas\* workpads with others, or on a website.

---

<div class="post-metadata">

**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\
**Post date:** [April 13, 2022, 12:39pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/3 "2022-04-13T12:39:43Z")

</div>

Hi @samuelD,

At the moment is not possible to use the slack connector from within Cases. It is on our radar and we would love to support it one day. What I don't understand is how the case and the alert are associated?

Best,  
Christos

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 13, 2022, 1:01pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/4 "2022-04-13T13:01:56Z")

</div>

@christos.nasikas thanks for the correction I read / thought alert not cases... TIL

---

<div class="post-metadata">

**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\
**Post date:** [April 13, 2022, 1:32pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/5 "2022-04-13T13:32:21Z")

</div>

@stephenb You are welcome! Using the slack connector as an action with alerts makes total sense. Understanding better the user flow and the correlation between cases and alerts would help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2022, 1:32pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207/6 "2022-05-11T13:32:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
