Skip to main content

STEP 4: Case/Ticket Creation

Procedures​

note

The threshold and requirements for escalating an alert to the point that it needs to be documented within a Case (Elastic Security) and/or Ticket/Issue (Redmine) is heavily dependant on the Mission Element Lead's preference.

If the initial triage assessment could not be attributed benign activity – then continue to the next step to Create a new Case

Elastic Security Case Creation Procedures:

  1. Within the expanded alert details, click on the Take Action button on the bottom right corner (or click the three dots ... in the alerts list) and either:

    • Select Add to existing case if this alert is being looked at as part of a related investigation or,

    • Select Add to new case as part of a new investigation

  2. If creating a new case, fill in the following fields and click Create Case when completed:

    FieldDescription
    NameEnter a unique descriptive name for the Case
    AssigneesUsers must have logged into Kibana at least once with their SSO logon to be listed as a potential Assignee
    TagsOptionally (unless specified by a lead), enter tags for easy identification and categorization of the case
    SeveritySelect a severity (this is highly dependent on the alert, lead priorities, and situation)
    DescriptionA description of the situation so that others do not have to re-analyze the alert for pertinent information
    • Ensure that Sync alert status with case status is toggled on
    • If available, set the External incident management system to Redmine

  3. If there are more than one Related alerts by process ancestry under the Insights section of the expanded alert details

    • Click on the Investigate in timeline button to open up a new timeline containing only those related alerts

    • For each alert in the list, click the three dots ... and select Add to existing case and add it to your recently created case