Summary
Adds a new Cases skill and four Agent Builder tools (search, manage, attachment, and observable tools) plus two new inline chat attachment types (single case and multiple cases) so agents can find, summarize, and update Elastic Security cases directly from a conversation, with results rendered inline instead of as plain text. This replaces the previous, more limited cases/agent-builder integration.
Why this needs docs: release_note:feature plus extensive public/ (attachments UI) and server/agent_builder files (skills, tools) indicate a major user-facing AI capability; the Agent Builder skills/tools reference pages exist but don't yet list this new Cases skill or its four tools.
Resources
- PR #271438 — [Cases] AB integration
Screenshots from PR
Availability
| Channel |
Details |
| Stack |
v9.5.0 |
| Serverless |
Jul 6–Jul 10 |
| Feature flag |
None — active by default |
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Elastic Agent Builder built-in skills reference > Security skills
- What the docs say: Security skills lists alert-analysis, entity-analytics, find-security-ml-jobs, threat-hunting, detection-rule-edit, and automatic_troubleshooting — there is no cases-related skill entry.
- What to add: Add a new definition for the Cases skill introduced in this PR (search/find cases, summarize findings, add comments) alongside the existing Security skills, following the same `<definition term="...">` pattern with assigned tools and prerequisites. Applies from 9.5.0, Security solution (stack and serverless where Agent Builder is enabled).
Elastic Agent Builder built-in tools reference > Security tools
- What the docs say: Security tools currently lists security.alerts, security.security_labs_search, security.create_detection_rule, security.get_entity, and security.search_entities. The generic platform.core.cases tool (GA since 9.3) is listed under Platform core tools, but is unrelated to the new Security-specific case tools.
- What to add: Add the four new Security-namespaced case tools (search cases, manage cases/attachments, observable tools) added in this PR to the Security tools section, distinguishing them from the pre-existing generic platform.core.cases tool. Applies from 9.5.0, Security solution.
Summary
Adds a new Cases skill and four Agent Builder tools (search, manage, attachment, and observable tools) plus two new inline chat attachment types (single case and multiple cases) so agents can find, summarize, and update Elastic Security cases directly from a conversation, with results rendered inline instead of as plain text. This replaces the previous, more limited cases/agent-builder integration.
Why this needs docs: release_note:feature plus extensive public/ (attachments UI) and server/agent_builder files (skills, tools) indicate a major user-facing AI capability; the Agent Builder skills/tools reference pages exist but don't yet list this new Cases skill or its four tools.
Resources
Screenshots from PR
Availability
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Elastic Agent Builder built-in skills reference > Security skills
Elastic Agent Builder built-in tools reference > Security tools