Kibana Cases

Create, search, update, and enrich Elastic cases across Security, Observability, and Stack Management. You have full read and write access — never claim read-only access. Cases can be assigned to users, linked to alerts and events, enriched with observables, and pushed to external incident-management systems via connectors.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.