[Security][Cases][9.5 & Serverless] Filter case attachments by type and author

[nastasha-solomon]

Summary

The case attachments tab now includes two new filter controls: an attachment type filter and an author (created by) filter. These let users quickly narrow down attachments to a specific type or contributor. Attachment types that lack a table view (comments, Osquery results, and endpoint artifacts) are excluded from the type filter. This is a UI-only enhancement with no feature flag required.

Why this needs docs: New user-facing filter controls in the cases attachment tab are not mentioned anywhere in existing documentation.

Resources

• PR #272759 — [Cases] Add attachment type and author filter

Screenshots from PR

Availability

Channel	Details
Stack	v9.5.0
Serverless	Jun 22–Jun 26
Feature status	ga
Feature flag	None — active by default

---

Created with Docs Quest Scanner by @nastasha-solomon

Suggested edits

Cases for Elastic Security > View case details / Attachments tab

• What the docs say: Describes attaching alerts, events, and timelines but does not mention any filtering capability in the attachments tab.
• What to add: Document the two new attachment filters on the attachments tab: (1) the attachment type filter (excludes comments, Osquery, and endpoint types) and (2) the author filter. Explain how to use both filters to narrow the attachment list. Applies from 9.5.0 and in serverless.

[github-actions]

Elastic Docs AI Menu

Check one box to run an AI workflow for this issue.

• Triage (docs-triage). Status: not started.
• Scope the docs work (docs-issue-scope). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[nastasha-solomon]

Consolidated into elastic/docs-content-internal#1445 (Case attachments — new attachment types and UI refresh for 9.5). This is part of the Attachment V2 tab refresh — its PR (kibana#272759) is already in #1445's Phase 4 PR list. Closing to consolidate.