Alert after new case escalation

[zenon8000]

Is it possible to create sigma rule and get alert after new case is created?

There is "so-case" idex but it is unaccessible for using this in sigma rules. Are there any alterting mechanism for cases?

[cm-ops]

By default the sigma rule will convert and the query will be looking in .ds-logs-*, the cases index is in the so-*.