security-case-management
Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.
Install
With your agent
Install OMGSkills skill "elastic/claude-plugin:skills/security/case-management" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/security/case-management ~/.claude/skills/security-case-managementFrom README
Case Management Manage SOC cases through the Kibana Cases API. All cases are scoped to securitySolution — this skill operates exclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts, and pushed to external incident management systems via connectors.
More from this repo
cloud-onboarding
Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default...
cloud-provisioning
Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
elasticsearch-anomaly-detection
Used to create and manage Elastic ML anomaly detection jobs via the API.