You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Create and manage cases[observability-create-a-new-case]
8
8
9
-
% What needs to be done: Align serverless/stateful
9
+
::::{admonition} Required role
10
+
:class: note
10
11
11
-
% Use migrated content from existing pages that map to this page:
12
+
**For Observability serverless projects**, the **Editor** role or higher is required to create and manage cases. To learn more, refer to [Assign user roles and privileges](../../../deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles).
% Internal links rely on the following IDs being on this page (e.g. as a heading ID, paragraph ID, etc):
17
16
18
-
$$$new-case-observability$$$
17
+
Open a new case to keep track of issues and share the details with colleagues. To create a case in your Observability project:
18
+
19
+
1. Find **Cases** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
20
+
2. Click **Create case**.
21
+
3. (Optional) If you defined [templates](../../../solutions/observability/incident-management/configure-case-settings.md#observability-case-settings-templates), select one to use its default field values. [preview]
22
+
4. Give the case a name, severity, and description.
23
+
24
+
::::{tip}
25
+
In the `Description` area, you can use [Markdown](https://www.markdownguide.org/cheat-sheet) syntax to create formatted text.
26
+
27
+
::::
28
+
29
+
5. (Optional) Add a category, assignees, and tags.
30
+
31
+
**For Observability serverless projects**, you can add users who are assigned the Editor user role (or a more permissive role) for the project.
32
+
33
+
**For Elastic Stack v9**, You can add users only if they meet the necessary [prerequisites](../../../solutions/observability/incident-management/configure-access-to-cases.md).
34
+
35
+
6. If you defined [custom fields](../../../solutions/observability/incident-management/configure-case-settings.md#observability-case-settings-custom-fields), they appear in the **Additional fields** section.
36
+
7. (Optional) Under External incident management system, you can select a connector to send cases to an external system. If you’ve created any connectors previously, they will be listed here. If there are no connectors listed, you can [create one](../../../solutions/observability/incident-management/configure-case-settings.md).
37
+
8. After you’ve completed all of the required fields, click **Create case**.
38
+
39
+
::::{tip}
40
+
You can also create a case from an alert or add an alert to an existing case. From the **Alerts** page, click the **More options***![More actions](../../../images/serverless-boxesHorizontal.svg"") icon and choose either ***Add to existing case** or **Create new case**, and select or complete the details as required.
To download or delete the file or copy the file hash to your clipboard, open the action menu (…). The available hash functions are MD5, SHA-1, and SHA-256.
56
+
57
+
When you upload a file, a comment is added to the case activity log. To view an image, click its name in the activity or file list.
58
+
59
+
::::{note}
60
+
Uploaded files are also accessible under **Project settings** → **Management** → **Files**. When you export cases as [saved objects](/explore-analyze/find-and-organize/saved-objects.md), the case files are not exported.
61
+
62
+
::::
63
+
64
+
65
+
You can add images and text, CSV, JSON, PDF, or ZIP files. For the complete list, check [`mime_types.ts`](https://github.com/elastic/kibana/blob/main/x-pack/plugins/cases/common/constants/mime_types.ts).
66
+
67
+
::::{admonition} File size limits
68
+
:class: note
69
+
70
+
There is a 10 MiB size limit for images. For all other MIME types, the limit is 100 MiB.
71
+
72
+
::::
73
+
74
+
75
+
## Send cases to external incident management systems [observability-create-a-new-case-send-cases-to-external-incident-management-systems]
76
+
77
+
To send a case to an external system, click the ![push](../../../images/serverless-importAction.svg"") button in the *External incident management system* section of the individual case page. This information is not sent automatically. If you make further changes to the shared case fields, you should push the case again.
78
+
79
+
For more information about configuring connections to external incident management systems, refer to [Configure case settings](../../../solutions/observability/incident-management/configure-case-settings.md).
You can search existing cases and filter them by attributes such as assignees, categories, severity, status, and tags. You can also select multiple cases and use bulk actions to delete cases or change their attributes.
85
+
86
+
To view a case, click on its name. You can then:
87
+
88
+
* Add a new comment.
89
+
* Edit existing comments and the description.
90
+
* Add or remove assignees.
91
+
* Add a connector (if you did not select one while creating the case).
92
+
* Send updates to external systems (if external connections are configured).
93
+
* Edit the category and tags.
94
+
* Change the status.
95
+
* Change the severity.
96
+
* Remove an alert.
97
+
* Refresh the case to retrieve the latest updates.
0 commit comments