Summary
PR #273455 moves observable extraction server-side so that observables are automatically populated not just from the Kibana UI, but also when alerts are added via the API, when cases are created through workflows or automations, and when cases are created via the Agent Builder. The internal 'extract observables' API endpoint has been removed; the feature is now built into the case client. The existing docs page describes observable auto-extraction as a subscription/version-gated feature but does not clarify the previous UI-only limitation or the new broader coverage across API and automation paths.
Why this needs docs: This is a meaningful behavioral change for users who rely on the API or automations — the docs should reflect that observable extraction now works across all case creation paths, not just the UI.
Resources
- PR #273455 — [Cases] Enable case observables extraction in automations and API
Availability
| Channel |
Details |
| Stack |
v9.4.0, v9.4.3, v9.5.0 |
| Serverless |
Jun 29–Jul 3 |
| Feature flag |
None — active by default |
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Attach objects to cases > Observables — auto-extraction
- What the docs say: You can manually add observables to cases or with the appropriate subscription, auto-extract them from alerts. Auto-extracting observables is only available in Elastic Security Serverless and Elastic Security 9.2+.
- What to add: The current text does not distinguish between UI-based and API/automation-based case creation paths. Before 9.4.0, auto-extraction only ran when cases were created through the Kibana UI; alerts added via the API or through workflows/automations did not trigger extraction. From 9.4.0, extraction runs server-side, so observables are auto-populated regardless of how the case is created — including via the REST API, workflow automations, and Agent Builder. The docs should be updated to reflect this expanded behavior. Applies from 9.4.0 and in serverless.
Summary
PR #273455 moves observable extraction server-side so that observables are automatically populated not just from the Kibana UI, but also when alerts are added via the API, when cases are created through workflows or automations, and when cases are created via the Agent Builder. The internal 'extract observables' API endpoint has been removed; the feature is now built into the case client. The existing docs page describes observable auto-extraction as a subscription/version-gated feature but does not clarify the previous UI-only limitation or the new broader coverage across API and automation paths.
Why this needs docs: This is a meaningful behavioral change for users who rely on the API or automations — the docs should reflect that observable extraction now works across all case creation paths, not just the UI.
Resources
Availability
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Attach objects to cases > Observables — auto-extraction