Case Management
- 8 installs
- 20 repo stars
- Updated July 8, 2026
- elastic/example-mcp-app-security
case-management drives Elastic Security SOC cases via elastic-security MCP tools.
About
case-management drives Elastic Security SOC cases via elastic-security MCP tools. Maps natural language requests to manage-cases dashboards, create-case, attach-alert-to-case, update-case, and add-case-comment with tag conventions for classification and MITRE techniques.
- Maps NL requests to manage-cases MCP tools.
- create-case and attach-alert-to-case flows.
- MITRE and classification tag conventions.
- Always calls tools instead of answering from memory.
Case Management by the numbers
- 8 all-time installs (skills.sh)
- Ranked #1,681 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 24, 2026 (Skillselion catalog sync)
case-management capabilities & compatibility
- Capabilities
- case management quick start · case management when to use guidance · case management integration patterns
- Works with
- elasticsearch
- Use cases
- security audit
What case-management says it does
Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this
skill when the user mentions cases, incidents, investigations, or asks to see, show,
npx skills add https://github.com/elastic/example-mcp-app-security --skill case-managementAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 8 |
|---|---|
| repo stars | ★ 20 |
| Last updated | July 8, 2026 |
| Repository | elastic/example-mcp-app-security ↗ |
How do I use case-management correctly?
Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or.
Who is it for?
Teams implementing case-management workflows from the research catalog.
Skip if: Skip when requirements clearly match a different specialized stack.
When should I use this skill?
User asks about case-management, create, search, update, and manage soc cases for elastic security. always use th.
What you get
Working case-management setup with validated configuration and next steps.
Files
Case Management
Manage SOC cases using the elastic-security MCP connector.
ALWAYS call the tool
When the user asks about cases, ALWAYS call manage-cases to open the interactive dashboard. Do not try to answer from memory or describe cases without calling the tool first.
| User says | Tool call |
|---|---|
| "show me my cases" | manage-cases (no params) |
| "any open cases?" | manage-cases with status: "open" |
| "closed cases" | manage-cases with status: "closed" |
| "cases for SRVWIN02" | manage-cases with search: "SRVWIN02" |
| "critical cases" | manage-cases with severity: "critical" |
| "show case 42" | manage-cases (user can click it in the dashboard) |
| "create a case" | create-case with title, description, tags, severity |
| "create a case for this alert" | create-case with alert details, then attach-alert-to-case |
Tools
| Tool | Purpose |
|---|---|
manage-cases | Opens interactive case dashboard. Params: status, severity, search |
create-case | Creates a new case. Params: title, description, tags (comma-separated), severity |
attach-alert-to-case | Attaches an alert to a case. Params: caseId, alertId, alertIndex, ruleId, ruleName |
update-case | Updates case status/severity. Params: caseId, version, status, severity |
add-case-comment | Adds investigation notes. Params: caseId, comment |
Creating Cases
When the user asks you to create a case, call create-case directly — do NOT tell them to use the dashboard UI.
Example:
create-case with:
title: "[MALICIOUS] Ransomware Attack Chain — srv-win-defend-01"
description: "## Summary\n- Full ransomware kill chain detected\n- Host: srv-win-defend-01\n- User: Jonathan\n\n## MITRE ATT&CK\nT1566, T1059, T1218\n\n## Findings\n..."
tags: "classification:malicious,confidence:high,host:srv-win-defend-01,mitre:T1566,mitre:T1059"
severity: "critical"After creating the case, if you have alert IDs, attach them with attach-alert-to-case.
Tag Conventions
| Tag pattern | Example | Purpose |
|---|---|---|
classification:<level> | classification:malicious | Triage result |
confidence:<score> | confidence:85 | Confidence 0-100 |
mitre:<technique> | mitre:T1574.002 | MITRE ATT&CK technique |
agent_id:<uuid> | agent_id:550888e5-... | Elastic agent ID |
rule:<name> | rule:Malware Detection | Detection rule name |
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does case-management do?
case-management drives Elastic Security SOC cases via elastic-security MCP tools.
When should I use case-management?
User asks about case-management, create, search, update, and manage soc cases for elastic security. always use th.
Is this skill safe to install?
Review the Security Audits panel on this page before installing in production.