Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/serverless/investigate/case-permissions.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ To grant access to cases in a custom role, set the privileges for the **Cases**

| Give full access to manage cases and settings
a| * **All** for the **Cases** feature under **Security**
* **All** for the **{connectors-feature}** feature under **Management**
* **All** for the **{connectors-feature}** feature under **Stack Management**

[NOTE]
====
Expand Down
6 changes: 3 additions & 3 deletions docs/serverless/investigate/cases-open-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -248,13 +248,13 @@ Use the **Export** option to move cases between different {elastic-sec} instance
====
The following attachments are _not_ exported:

* **Case files**: Case files are not exported. However, they are accessible in **Project settings** → **Management** → **Files** to download and re-add.
* **Case files**: Case files are not exported. However, they are accessible in **Project Settings** → **Stack Management** → **Files** to download and re-add.
* **Alerts**: Alerts attached to cases are not exported. You must re-add them after importing cases.
====

To export a case:

. Go to **Project settings** → **Management** → **Saved objects**.
. Go to **Project Settings** → **Stack Management** → **Saved objects**.
. Search for the case by choosing a saved object type or entering the case title in the search bar.
. Select one or more cases, then click the **Export** button.
. Click **Export**. A confirmation message that your file is downloading displays.
Expand Down Expand Up @@ -283,6 +283,6 @@ To import a case:
====
Be mindful of the following:

* If the imported case had connectors attached to it, you'll be prompted to re-authenticate the connectors. To do so, click **Go to connectors** on the **Import saved objects** flyout and complete the necessary steps. Alternatively, open the main menu, then go to **Project settings** → **Management** → **{connectors-ui}** to access connectors.
* If the imported case had connectors attached to it, you'll be prompted to re-authenticate the connectors. To do so, click **Go to connectors** on the **Import saved objects** flyout and complete the necessary steps. Alternatively, open the main menu, then go to **Project Settings** → **Stack Management** → **{connectors-ui}** to access connectors.
* If the imported case had attached alerts, verify that the alerts' source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts' source documents to function.
====
Loading