[Security][Cases][9.3 & Serverless]: Enhance cases search in all cases view

explore-analyze/alerts-cases/cases/manage-cases.md

@@ -147,4 +147,9 @@ To view a case, click on its name. You can then:
 * Add and manage the following items:
    * Alerts
    * Files
-   * Observables
+   * Observables
+
+## Search cases [search-stack-management-cases]
+
+:::{include} /solutions/_snippets/search-cases.md
+:::

solutions/_snippets/search-cases.md

@@ -0,0 +1,3 @@
+Use the search bar on the **Cases** page to quickly find cases and case data. You can search for case titles, descriptions, and IDs. Keywords and text search is supported.
+
+{applies_to}`stack: ga 9.3` You can also search for alert and event IDs, observable values, case comments, and custom fields (text type only). For example, you can search for a specific IP address that's been specified as an observable, a colleague's comment, or the ID of an alert that's attached to the case.

solutions/observability/incident-management/create-manage-cases.md

@@ -102,4 +102,9 @@ To view a case, click on its name. You can then:
 * Refresh the case to retrieve the latest updates.
 * Add and manage the following items:
    * Alerts
-   * Files
+   * Files
+
+## Search cases [search-observability-cases]
+
+:::{include} /solutions/_snippets/search-cases.md
+:::

solutions/security/investigate/open-manage-cases.md

@@ -219,7 +219,7 @@ An observable is a piece of information about an investigation, for example, a s
 To view and manage observables, go to the **Observables** tab. You can find the tab in the following places:
 
 - {applies_to}`stack: ga 9.3`: Go to the case's details page, then select the **Attachments** tab.
-- {applies_to}`stack: ga 9.2`: Go to the case's details page.  
+- {applies_to}`stack: ga 9.0`: Go to the case's details page.  
 
 ::::{important}
 Each case can have a maximum of 50 observables.
@@ -316,4 +316,9 @@ To import a case:
     * If the imported case had connectors attached to it, you’ll be prompted to re-authenticate the connectors. To do so, click **Go to connectors** on the **Import saved objects** flyout and complete the necessary steps. You can also access connectors from the **{{connectors-ui}}** page (find **{{connectors-ui}}** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md)).
     * If the imported case had attached alerts, verify that the alerts' source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts' source documents to function.
 
-    ::::
+    ::::
+
+## Search cases [search-security-cases]
+
+:::{include} /solutions/_snippets/search-cases.md
+:::