How do I install the Security Case Management skill?

Run npx skillmds@latest add aspectrr/security-case-management in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Case Management safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Case Management?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Case Management free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Case Management?

aspectrr (@aspectrr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Case Management by aspectrr

Name: Security Case Management
Author: aspectrr

File contents

Case Management

Manage SOC cases through the Kibana Cases API. All cases scoped to securitySolution.

Prerequisites

export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"

Quick start

# Create
node skills/security/case-management/scripts/case-manager.js create \
  --title "Malicious DLL sideloading on host1" \
  --description "Crypto clipper malware detected..." \
  --tags "classification:malicious" "confidence:88" "mitre:T1574.002" \
  --severity critical --yes

# Find by tags or search
node skills/security/case-management/scripts/case-manager.js find --tags "agent_id:<id>"
node skills/security/case-management/scripts/case-manager.js find --search "DLL sideloading" --status open

# List, get
node skills/security/case-management/scripts/case-manager.js list --status open --per-page 10
node skills/security/case-management/scripts/case-manager.js get --case-id <case_id>

# Attach alert
node skills/security/case-management/scripts/case-manager.js attach-alert \
  --case-id <case_id> --alert-id <alert_id> --alert-index <index> \
  --rule-id <rule_uuid> --rule-name "<name>"

# Attach multiple alerts (batch)
node skills/security/case-management/scripts/case-manager.js attach-alerts \
  --case-id <case_id> --alert-ids <id1> <id2> \
  --alert-index <index> --rule-id <uuid> --rule-name "<name>"

# Add comment, update
node skills/security/case-management/scripts/case-manager.js add-comment \
  --case-id <case_id> --comment "Process tree analysis shows..."
node skills/security/case-management/scripts/case-manager.js update \
  --case-id <case_id> --status closed --severity low --yes

Tag conventions

Tag pattern	Example	Purpose
`classification:<value>`	`classification:malicious`	Triage classification
`confidence:<score>`	`confidence:85`	Confidence score 0-100
`mitre:<technique>`	`mitre:T1574.002`	MITRE ATT&CK technique
`agent_id:<id>`	`agent_id:550888e5-...`	Agent ID for correlation

Case severity mapping

Classification	Kibana severity
benign (score 0-19)	`low`
unknown (score 20-60)	`medium`
malicious (score 61-80)	`high`
malicious (score 81-100)	`critical`

Guidelines

Report only tool output — do not invent IDs, hostnames, or details.
Copy exact titles verbatim from API responses.
Write operations prompt for confirmation. Pass --yes to skip.
Verify environment variables before running commands.

---name: security-case-managementdescription: Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.---# Case ManagementManage SOC cases through the Kibana Cases API. All cases scoped to `securitySolution`.## Prerequisites```bashexport KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"export KIBANA_API_KEY="your-kibana-api-key"```## Quick start```bash# Createnode skills/security/case-management/scripts/case-manager.js create \ --title "Malicious DLL sideloading on host1" \ --description "Crypto clipper malware detected..." \ --tags "classification:malicious" "confidence:88" "mitre:T1574.002" \ --severity critical --yes# Find by tags or searchnode skills/security/case-management/scripts/case-manager.js find --tags "agent_id:<id>"node skills/security/case-management/scripts/case-manager.js find --search "DLL sideloading" --status open# List, getnode skills/security/case-management/scripts/case-manager.js list --status open --per-page 10node skills/security/case-management/scripts/case-manager.js get --case-id <case_id># Attach alertnode skills/security/case-management/scripts/case-manager.js attach-alert \ --case-id <case_id> --alert-id <alert_id> --alert-index <index> \ --rule-id <rule_uuid> --rule-name "<name>"# Attach multiple alerts (batch)node skills/security/case-management/scripts/case-manager.js attach-alerts \ --case-id <case_id> --alert-ids <id1> <id2> \ --alert-index <index> --rule-id <uuid> --rule-name "<name>"# Add comment, updatenode skills/security/case-management/scripts/case-manager.js add-comment \ --case-id <case_id> --comment "Process tree analysis shows..."node skills/security/case-management/scripts/case-manager.js update \ --case-id <case_id> --status closed --severity low --yes```## Tag conventions| Tag pattern | Example | Purpose || ------------------------ | ----------------------------------- | ------------------------ || `classification:<value>` | `classification:malicious` | Triage classification || `confidence:<score>` | `confidence:85` | Confidence score 0-100 || `mitre:<technique>` | `mitre:T1574.002` | MITRE ATT&CK technique || `agent_id:<id>` | `agent_id:550888e5-...` | Agent ID for correlation |## Case severity mapping| Classification | Kibana severity || ------------------------ | --------------- || benign (score 0-19) | `low` || unknown (score 20-60) | `medium` || malicious (score 61-80) | `high` || malicious (score 81-100) | `critical` |## Guidelines- Report only tool output — do not invent IDs, hostnames, or details.- Copy exact titles verbatim from API responses.- Write operations prompt for confirmation. Pass `--yes` to skip.- Verify environment variables before running commands.

Frequently asked questions

Security Case Management