diff --git a/docs/cases/cases-manage.asciidoc b/docs/cases/cases-manage.asciidoc index 917810ad4d..e4cf5b0d0c 100644 --- a/docs/cases/cases-manage.asciidoc +++ b/docs/cases/cases-manage.asciidoc @@ -11,7 +11,7 @@ Open a new case to keep track of security issues and share their details with colleagues. . Go to *Cases*, then click *Create case*. If no cases exist, the Cases table will be empty and you'll be prompted to create one by clicking the *Create case* button inside the table. -. Give the case a name, add relevant tags, assign a severity level, and provide a description. You can use +. Give the case a name, assign a severity level, and provide a description. You can use https://www.markdownguide.org/cheat-sheet[Markdown] syntax in the case description. + NOTE: If you do not assign your case a severity level, it will be assigned *Low* by default. @@ -19,8 +19,11 @@ NOTE: If you do not assign your case a severity level, it will be assigned *Low* + TIP: You can insert a Timeline link in the case description by clicking the Timeline icon (image:images/add-timeline-button.png[Timeline icon,17,17]). +. Optionally, add assignees and relevant tags. You can add users only if they +meet the necessary <>. + . Choose if you want alert statuses to sync with the case's status after they are added to the case. This option is enabled by default, but you can turn it off after creating the case. -. From *External incident management*, select a <>. If you’ve previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`. +. From *External incident management*, select a <>. If you've previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`. . Click *Create case*. + NOTE: If you've selected a connector for the case, the case is automatically pushed to the third-party system it's connected to. @@ -33,7 +36,9 @@ image::images/cases-ui-open.png[Shows an open case] [[cases-ui-manage]] == Manage existing cases -From the Cases page, you can search existing cases and filter them by severity, tags, reporter, and status: `Open`, `In progress`, or `Closed`. General case metrics, including how long it takes to close cases, are provided above the table. +From the Cases page, you can search existing cases and filter them by assignee, +severity, status, and tags. General case metrics, including how long it takes to +close cases, are provided above the table. [role="screenshot"] image::images/cases-home-page.png[Case UI Home] @@ -45,10 +50,11 @@ To explore a case, click on its name. You can then: + TIP: Comments can contain Markdown. For syntax help, click the Markdown icon (image:images/markdown-icon.png[Click markdown icon,17,17]) in the bottom right of the comment. -* <> +* <> * <> * Modify the case's description -* <> and send updates to external systems (if you've added a connector to the case) +* Add or remove assignees +* <> and send updates to external systems (if you've added a connector to the case) * Close the case or reopen it * Edit tags * Update the case's severity diff --git a/docs/cases/cases-overview.asciidoc b/docs/cases/cases-overview.asciidoc index 2821561d6a..722b74642e 100644 --- a/docs/cases/cases-overview.asciidoc +++ b/docs/cases/cases-overview.asciidoc @@ -3,7 +3,7 @@ = Cases -Collect and share information about security issues by opening a case in {elastic-sec}. Cases allow you to track key investigation details, collect alerts in a central location, and more. The {elastic-sec} UI provides several ways to create and manage cases. Alternatively, you can use the <> to perform the same tasks. +Collect and share information about security issues by opening a case in {elastic-sec}. Cases allow you to track key investigation details, collect alerts in a central location, and more. The {elastic-sec} UI provides several ways to create and manage cases. Alternatively, you can use the <> to perform the same tasks. You can also send cases to these external systems by <>: diff --git a/docs/cases/images/add-vis-to-case.gif b/docs/cases/images/add-vis-to-case.gif index f6918496e2..7edc7260f4 100644 Binary files a/docs/cases/images/add-vis-to-case.gif and b/docs/cases/images/add-vis-to-case.gif differ diff --git a/docs/cases/images/cases-home-page.png b/docs/cases/images/cases-home-page.png index 12061dd3c4..616c43e52c 100644 Binary files a/docs/cases/images/cases-home-page.png and b/docs/cases/images/cases-home-page.png differ diff --git a/docs/cases/images/cases-manage-comments.png b/docs/cases/images/cases-manage-comments.png index 8612ac725a..b145e42dd2 100644 Binary files a/docs/cases/images/cases-manage-comments.png and b/docs/cases/images/cases-manage-comments.png differ diff --git a/docs/cases/images/cases-open-vis.png b/docs/cases/images/cases-open-vis.png index 890c856ddc..f1c7883f7e 100644 Binary files a/docs/cases/images/cases-open-vis.png and b/docs/cases/images/cases-open-vis.png differ diff --git a/docs/cases/images/cases-summary.png b/docs/cases/images/cases-summary.png index b9d8d51100..400804c23f 100644 Binary files a/docs/cases/images/cases-summary.png and b/docs/cases/images/cases-summary.png differ diff --git a/docs/cases/images/cases-ui-open.png b/docs/cases/images/cases-ui-open.png index 1db008f83e..bee5ed56c1 100644 Binary files a/docs/cases/images/cases-ui-open.png and b/docs/cases/images/cases-ui-open.png differ diff --git a/docs/getting-started/cases-req.asciidoc b/docs/getting-started/cases-req.asciidoc index b48d2aeff9..023df1fe31 100644 --- a/docs/getting-started/cases-req.asciidoc +++ b/docs/getting-started/cases-req.asciidoc @@ -22,16 +22,23 @@ To grant access to cases, set the {kib} space privileges for the *Cases* and *{c | Action | {kib} Privileges | Give full access to manage cases a| -* `All` for the *Cases* feature -* `All` for the *{connectors-feature}* feature (go to *Management > {connectors-feature}* to set this) +* `All` for the *Cases* feature under *Security* +* `All` for the *{connectors-feature}* feature under *Management* NOTE: Roles without `All` *{connectors-feature}* feature privileges cannot create, add, delete, or modify case connectors. -| Give view-only access for cases | `Read` for the *Cases* feature +| Give assignee access to cases +a| +* `All` for the *Cases* feature under *Security* + +NOTE: Before a user can be assigned to a case, they must log into {kib} at least +once, which creates a user profile. + +| Give view-only access for cases | `Read` for the *Cases* feature under *Security* -| Give access to view and delete cases | `Read` for the *Cases* feature and the *Delete* sub-feature selected +| Give access to view and delete cases | `Read` for the *Cases* feature under *Security* with the *Delete* sub-feature selected -| Revoke all access to cases | `None` for the *Cases* feature | +| Revoke all access to cases | `None` for the *Cases* feature under *Security* |==============================================