You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit

Cases requirements

Requirements for using and managing cases.

User roles define feature privileges at different levels to manage feature access. To access cases, you must have the appropriate user role.


To send cases to external systems, you need the Security Analytics Complete project feature.


Certain feature tiers and roles might be required to manage case attachments. For example, to add alerts to cases, you must have a role that allows managing alerts.

On this page