Skip to content

[Cases] Add auto-push case option to case connector#249251

Merged
janmonschke merged 14 commits intoelastic:mainfrom
janmonschke:cases/automatically-push-case-from-rule-action
Jan 26, 2026
Merged

[Cases] Add auto-push case option to case connector#249251
janmonschke merged 14 commits intoelastic:mainfrom
janmonschke:cases/automatically-push-case-from-rule-action

Conversation

@janmonschke
Copy link
Copy Markdown
Contributor

@janmonschke janmonschke commented Jan 15, 2026 •
edited
Loading

Summary

Addresses https://github.com/elastic/security-team/issues/15315

image

Adds the option to auto-push a case when a case template with connector is defined.

Testing

  • Add a case template with connector
  • Create a new rule with a case connector (group by agent.id, time window 5min)
  • Generate events
  • Check that cases are automatically push
  • Check that the telemetry counter is incremented correctly:
GET .kibana_usage_counters/_search
{
    "query": {
        "prefix": {
          "usage-counter.counterName": {
            "value": "CasesPush"
          }
        }
    },
    "fields": [
      "usage-counter.counterName",
      "usage-counter.count"
    ],
    "_source": false
}

@janmonschke janmonschke added backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:Cases Security Solution Cases team labels Jan 22, 2026
@janmonschke janmonschke marked this pull request as ready for review January 22, 2026 13:24
@janmonschke janmonschke requested a review from a team as a code owner January 22, 2026 13:24
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 22, 2026

Pinging @elastic/kibana-cases (Team:Cases)

@janmonschke janmonschke changed the title [Cases][draft] Add auto-push case option [Cases] Add auto-push case option to case connector Jan 22, 2026
@janmonschke janmonschke mentioned this pull request Jan 22, 2026
Closed
NicholasPeretti
NicholasPeretti previously approved these changes Jan 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@NicholasPeretti NicholasPeretti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great! Thank you for fixing this ☺️

@NicholasPeretti NicholasPeretti dismissed their stale review January 26, 2026 14:12

Sorry, approved by mistake

MykhailoKondrat
MykhailoKondrat reviewed Jan 26, 2026
View reviewed changes
x-pack/platform/plugins/shared/cases/server/connectors/cases/cases_connector_executor.ts
pushType: 'automatic',
})
.catch((error) => {
this.logger.debug(
Copy link
Copy Markdown
Contributor

@MykhailoKondrat MykhailoKondrat Jan 26, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In other places in this file we are using if (this.logger.isLevelEnabled('debug')) check, maybe we want to add it here too ( or change log level )

Copy link
Copy Markdown
Contributor Author

@janmonschke janmonschke Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not needed in this context. It's handy when the logging operation is more expensive (e.g. if we need to calculate or query sth). But good catch :)

@janmonschke janmonschke enabled auto-merge (squash) January 26, 2026 21:09
@janmonschke janmonschke merged commit c8b161d into elastic:main Jan 26, 2026
16 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 26, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #69 / "before all" hook in "{root}"
  • [job] [logs] FTR Configs #88 / Cloud Security Posture Test adding Cloud Security Posture Integrations CNVM CNVM AWS On Add Agent modal there should be modal that has Cloud Formation details as well as button that redirects user to Cloud formation page on AWS upon clicking them

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 1.4MB 1.4MB +445.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 145.0KB 145.1KB +153.0B
Unknown metric groups

ESLint disabled line counts

id before after diff
cases 72 73 +1

Total ESLint disabled count

id before after diff
cases 84 85 +1

History

@divyaaghi-qasource
Copy link
Copy Markdown

divyaaghi-qasource commented Mar 23, 2026

Hi @janmonschke and @vgomez-el

We are currently working on feature testing around this feature on 9.4 snapshot build.

As per the ticket reported regarding Cases Connectors, our testing scope regarding this feature ticket has been decreased.

Please let us know if anything else is required from our end!

Thanks!

@janmonschke
Copy link
Copy Markdown
Contributor Author

janmonschke commented Mar 23, 2026

@divyaaghi-qasource The linked ticket and this PR are two distinct features. This PR adds new functionality.

@divyaaghi-qasource
Copy link
Copy Markdown

divyaaghi-qasource commented Mar 23, 2026

Hi @janmonschke

Thanks for the clarification.

Yes, we agree these are separate from the linked ticket, and we’re continuing to test this PR’s new functionality on the 9.4 snapshot build.

One note on scope: our end-to-end verification that cases are successfully pushed to the external system is currently reduced because the login credentials to the connected external system are not working on our side. We can still validate the Kibana-side behavior (configuration/option, UI flow, and that the push action is triggered), but we can’t fully confirm the external third party connector's status right now.

Please let us know if we missed anything.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MykhailoKondrat MykhailoKondrat MykhailoKondrat approved these changes

@NicholasPeretti NicholasPeretti NicholasPeretti left review comments

Assignees

No one assigned

Labels

backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:Cases Security Solution Cases team v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@janmonschke @elasticmachine @divyaaghi-qasource @NicholasPeretti @MykhailoKondrat @kibanamachine