Using Case templates in Attack Discovery scheduling

Elastic Security
4

Hi David. Today we used a Case template which has a connector for our ticketing system where we use the following fields:

Fields for Creating the Case in ITSM
{{{case.title}}}
{{{case.description}}}
{{{case.severity}}}
{{{case.tags}}}

The connector we use is the Webhook Case Management.

What I found strange is that when selecting the Case option in the Attack Discovery scheduling, I can't select a Case Template that I already have. If I could insert an already created Case Template, I could make the necessary modifications for sending it to my ticketing system, however, what I observed is that Attack Discovery itself inserts the fields.

How would I use a Case Template that has already been created?

Thank you in advance for your attention.

1 Like