[Cases] Add cases workflow steps by janmonschke · Pull Request #253119 · elastic/kibana

janmonschke · 2026-02-13T18:43:10Z

Summary

This PR adds ~~five~~four ~~new~~ enhanced case workflow steps:

cases.createCase: Does not require user to add optional fields, supports adding a connector, better autocompletion
cases.updateCase: Does not require user to specify a version, eliminating the need to fetch the case in the step before. Better autocompletion.
cases.getCase: Gets a case by id
cases.addCaseComment: Adds a comment to a case with better autocompletion
cases.createCaseFromTemplate: Creates a case from an autocompleted case template.

What, 5? I thought it was 4!? Well, yes. Technically there are 5 steps in this PR but only 4 of them are activated. cases.createCaseFromTemplate depends on workflow improvements mentioned in #253568 (namely owner inspection).

Note: all steps also support pushing the case after completion by setting the push-case property to true.

Testing

Add the following to your kibana.dev.yml:

uiSettings:
  overrides:
    bfetch:disableCompression: true
    workflows:ui:enabled: true

I encourage you to check out the code locally and to play around with the workflow feature to get a feel for the autocompletion and how case steps behave. If you notice anything that should be enhanced, add a comment here.

Here's a workflow spec that uses all (enabled) case steps:

Click to reveal yaml file

name: Case workflow kitchen sink
enabled: false
description: Tests all the case stes
triggers:
  - type: manual
steps:
  - name: create_case
    type: cases.createCase
    push-case: true
    connector-id: ba236d8b-67fb-47d6-8df8-bba91381beb1
    with:
      description: "Test description"
      title: "test title"
      owner: securitySolution
      settings:
        syncAlerts: false
  - name: update_case
    type: cases.updateCase
    with:
      case_id: "{{steps.create_case.output.case.id}}"
      updates:
        status: in-progress
        title: The title changed
  - name: add_comment
    type: cases.addComment
    with:
      case_id: "{{steps.update_case.output.case.id}}"
      comment: "Test comment"
  - name: get_case
    type: cases.getCase
    with:
      case_id: "{{steps.add_comment.output.case.id}}"
      include_comments: false

Notes

Reach out to me on Slack for cloud env & connector credentials.

⏳ Build in-progress

History

💔 Build #401286 failed 739fe4b
💚 Build #401176 succeeded 9edb086
💚 Build #400774 succeeded f303ec3
💛 Build #400034 was flaky fc8b1a5
💔 Build #399926 failed e3689ed

## Summary <img width="1212" height="720" alt="image" src="https://github.com/user-attachments/assets/59397721-4024-4877-8781-d7736b1d3628" /> This PR adds ~~five~~four ~~new~~ enhanced case workflow steps: 1. `cases.createCase`: Does not require user to add optional fields, supports adding a connector, better autocompletion 2. `cases.updateCase`: Does not require user to specify a `version`, eliminating the need to fetch the case in the step before. Better autocompletion. 3. `cases.getCase`: Gets a case by id 4. `cases.addCaseComment`: Adds a comment to a case with better autocompletion 5. `cases.createCaseFromTemplate`: Creates a case from an autocompleted case template. What, 5? I thought it was 4!? Well, yes. Technically there are 5 steps in this PR but only 4 of them are activated. `cases.createCaseFromTemplate` depends on workflow improvements mentioned in elastic#253568 (namely `owner` inspection). Note: **all** steps also support pushing the case after completion by setting the `push-case` property to `true`. ## Testing Add the following to your `kibana.dev.yml`: ```yml uiSettings: overrides: bfetch:disableCompression: true workflows:ui:enabled: true ``` I encourage you to check out the code locally and to play around with the workflow feature to get a feel for the autocompletion and how case steps behave. If you notice anything that should be enhanced, add a comment here. Here's a workflow spec that uses all (enabled) case steps: <details> <summary>Click to reveal yaml file</summary> ```yaml name: Case workflow kitchen sink enabled: false description: Tests all the case stes triggers: - type: manual steps: - name: create_case type: cases.createCase push-case: true connector-id: ba236d8b-67fb-47d6-8df8-bba91381beb1 with: description: "Test description" title: "test title" owner: securitySolution settings: syncAlerts: false - name: update_case type: cases.updateCase with: case_id: "{{steps.create_case.output.case.id}}" updates: status: in-progress title: The title changed - name: add_comment type: cases.addComment with: case_id: "{{steps.update_case.output.case.id}}" comment: "Test comment" - name: get_case type: cases.getCase with: case_id: "{{steps.add_comment.output.case.id}}" include_comments: false ``` </details> ## Notes Reach out to me on Slack for cloud env & connector credentials. ## Meta Depends on: elastic#253568 Partially implements: elastic/security-team#15084 Fixes elastic/security-team#15969 --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Mykhailo Kondrat <247111948+mykhailokondrat@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Sergi Massaneda <sergi.massaneda@elastic.co>

janmonschke added 5 commits January 27, 2026 12:19

first steps

4f0892f

progress

682dfbd

Merge branch 'main' into cases/workflow-steps

16ae49f

progress

4f5ec6c

more steps and more autocompletion

f635768

janmonschke added backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:Cases Security Solution Cases team labels Feb 13, 2026

janmonschke added 7 commits February 14, 2026 18:51

translations and refactorings

7b03943

Add connector-id and push-case config

7fde4e9

push-case and harden types

e023fdd

Merge branch 'main' into cases/workflow-steps

2c5f6ee

cleanup and adding scaffold for createCaseFromTemplae

311c399

add extractObservables

89f3173

test work

0b34b33

janmonschke added the ci:cloud-deploy Create or update a Cloud deployment label Feb 18, 2026

Merge branch 'main' into cases/workflow-steps

0f84ee1

janmonschke marked this pull request as ready for review February 18, 2026 18:31

janmonschke requested a review from a team as a code owner February 18, 2026 18:31

janmonschke changed the title ~~[DRAFT][Cases] Add cases workflow steps~~ [Cases] Add cases workflow steps Feb 18, 2026

Changes from make api-docs

145917a

elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner February 18, 2026 18:42

kibanamachine and others added 5 commits February 18, 2026 18:53

Changes from node scripts/lint_packages --fix

21804b6

Changes from node scripts/regenerate_moon_projects.js --update

ddb078a

remove duplicate eui_icons.d.ts

8a2ee4e

cleanup

fcf348e

update limits

b5f8a24

janmonschke requested a review from a team as a code owner February 18, 2026 19:25

fix jest tests

420c1aa

Merge branch 'main' into cases/workflow-steps

fc81939

jbudz approved these changes Feb 23, 2026

View reviewed changes

christineweng reviewed Feb 23, 2026

View reviewed changes

janmonschke and others added 6 commits February 24, 2026 09:52

use max comment const

21c0459

no need for partial anymore

51e7e29

PR feedback

e1f86a3

Changes from node scripts/eslint_all_files --no-cache --fix

e3689ed

fix tests

a435ae7

make it a partial again

fc8b1a5

christineweng approved these changes Feb 24, 2026

View reviewed changes

Merge branch 'main' into cases/workflow-steps

f303ec3

semd reviewed Feb 25, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/public/workflows/create_case.tsx Outdated

janmonschke and others added 4 commits February 26, 2026 08:27

remove connector

9edb086

Merge branch 'main' into cases/workflow-steps

98de226

fix workflows icons issues

0efaa9e

Merge remote-tracking branch 'refs/remotes/janmonschke/cases/workflow…

739fe4b

…-steps' into cases/workflow-steps

semd reviewed Feb 26, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/public/workflows/get_case.tsx

janmonschke added 2 commits February 27, 2026 15:23

add and disable caseId inputHandler

c643cd3

update labels

98c3426

semd reviewed Feb 27, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/common/workflows/steps/create_case_from_template.ts Outdated

semd approved these changes Feb 27, 2026

View reviewed changes

case-template-id -> case_template_id

9969f51

Merge branch 'main' into cases/workflow-steps

6bf3907

janmonschke enabled auto-merge (squash) February 27, 2026 19:36

janmonschke merged commit 1b27634 into elastic:main Feb 27, 2026
16 checks passed

kibanamachine added the v9.4.0 label Feb 27, 2026

+                  documentation: {
+                    details: i18n.CREATE_CASE_STEP_DOCUMENTATION_DETAILS,
+                    examples: [
+                      `## Basic case creation

Conversation

janmonschke commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Notes

Meta

Uh oh!

elasticmachine commented Feb 18, 2026

Uh oh!

janmonschke commented Feb 23, 2026

Uh oh!

christineweng left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

christineweng Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

semd left a comment

Choose a reason for hiding this comment

Uh oh!

janmonschke commented Feb 27, 2026

Uh oh!

elasticmachine commented Feb 27, 2026

⏳ Build in-progress

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

janmonschke commented Feb 13, 2026 •

edited

Loading