Cases requirements
editCases requirements
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
To access cases, you need either the appropriate predefined Security user role or a custom role with the right privileges.
You can create custom roles and define feature privileges at different levels to manage feature access in Kibana. Kibana privileges grant access to features within a specified Kibana space, and you can grant full or partial access. For more information, refer to Custom roles.
To send cases to external systems, you need the Security Analytics Complete project feature.
Certain feature tiers and roles might be required to manage case attachments. For example, to add alerts to cases, you must have a role that allows managing alerts.
To grant access to cases in a custom role, set the privileges for the Cases and Actions and Connectors features as follows:
| Action | Kibana Privileges |
|---|---|
Give full access to manage cases and settings |
Roles without All privileges for the Actions and Connectors feature cannot create, add, delete, or modify case connectors. By default, All for the Cases feature allows you to delete cases, delete alerts and comments from cases, and edit case settings. You can customize the sub-feature privileges to limit feature access. |
Give assignee access to cases |
All for the Cases feature under Security Before a user can be assigned to a case, they must log into Kibana at least once, which creates a user profile. |
Give view-only access for cases |
Read for the Security feature and All for the Cases feature You can customize the sub-feature privileges to allow access to deleting cases, deleting alerts and comments from cases, and viewing or editing case settings. |
Revoke all access to cases |
None for the Cases feature under Security |