Skip to content

create-case-templates.md

Latest commit

 

History

History
85 lines (59 loc) · 4.67 KB

create-case-templates.md

File metadata and controls

85 lines (59 loc) · 4.67 KB
Raw
navigation_title Create templates
applies_to
stack serverless
ga 9.5
ga
products
id
kibana
id
security
id
observability
id
cloud-serverless
type how-to
description Create YAML-defined case templates that pre-fill case defaults, field library values, connectors, and case settings.

Create case templates [create-case-templates]

Create a case template to pre-fill case defaults whenever your team opens a similar case. On the Configuration tab, you also set the template's identity, optional case settings, and an optional external connector. This guide shows you how to configure a template and author its YAML.

Before you begin

Create a template [case-templates-create-template]

The template editor has a YAML pane and a preview pane with Fields and Configuration tabs:

  • Fields: Define case defaults and custom fields in YAML, and preview how they render on a case. Changes in the preview sync back to the YAML. Use the Actions menu to quickly insert scaffolding for any field type, pull in a reusable field from your library, or add validation and conditional logic.
  • Configuration: Set the template's identity, case settings, and an optional external connector. These values aren't part of the YAML definition.

To create a template:

  1. Find Cases using the global search field, then select Templates → Create.

    :::{note} Cases are scoped by solution. On {{stack}}, search for Security/Cases or Observability/Cases, or go to {{stack-manage-app}} → Cases. On {{serverless-short}}, search for Cases in {{elastic-sec}} or {{observability}}. :::

  2. On the Fields tab, define case defaults and the fields to pre-fill. Use the Actions menu to insert scaffolding for a new field, reference a reusable field from your field library, or add validation and conditional logic. The preview pane updates in real time so you can see how fields look and behave before saving. Refer to the YAML schema reference for the full set of supported keys.

    :::{note} A template can have up to 200 custom fields. :::

  3. On the Configuration tab, enter a template name. Optionally add a description, tags, case settings (Sync alerts and Extract observables), and an external connector.

    :::{note} Extract observables is available in {{elastic-sec}} only. :::

  4. Select Create. The template is enabled by default so it's available when creating a case.

As you edit, the editor validates your YAML and suggests values. While you're editing, your changes are saved as a draft so you don't lose your work. Select Reset to discard the draft and return to the last saved version.

Add reusable fields from the library [case-templates-field-ref]

Global fields appear on every case automatically, so you don't add them to a template. To include a reusable field, use the Actions menu and select Field library. Search for the field by name, select it, and the correct $ref YAML is inserted for you.

If you prefer to write the reference directly, use $ref with the field's name (not its label) on the Fields tab. Use the field's label when you search cases.

For example, to add the summary field from the library:

fields:
  - $ref: summary

A reference can also use a different name for that template, or override the field's default value, without changing the original field in the library:

fields:
  - $ref: summary
    name: incident_summary
    metadata:
      default: A different default for this template

What to do next with case templates [create-case-templates-next-steps]

From here, you can use the template on cases and update it later if your workflow changes.