Description

Today, a user can add an alert to a Case, which is an event with event.kind:signal
We are extending this to any event.

Background & resources

• PRs: [Cases] Events as attachments kibana#230970 [Cases][Security Solution] Bulk event actions for explore kibana#236420
• Issues/metas: https://github.com/elastic/security-team/issues/5061
• Point of contact: @lgestc
• Test environments:

Which documentation set does this change impact?

ESS and serverless

ESS release

Ess 9.2

Serverless release

Week of Sept 29

Feature differences

identical

API docs impact

it is now possible to create a new attachment, of type 'event' when posting to cases comment endpoint

Prerequisites, privileges, feature flags

UI changes are only enabled for Security Solution for now