Changes to Security cases in 8.8

[nastasha-solomon]

Description

Using this doc issue to track changes related to Security cases in 8.8.

Changes to document

• [Cases][Meta]: File attachments kibana#151595 and [Cases] Attaching files to cases kibana#154436: Users can attach files to cases. This doc update is being tracked in [DOCS] Case file attachments kibana#154881 and will be made in the Security docs by @lcawl in [DOCS] Case file attachments #3236.
  • Attached files aren't exported as "related objects" when users export cases. Users will need to download the files from the case and re-upload them after they import the exported case. This limitation will prob need to mentioned in the feature docs.
  • [Cases] Adding files configuration fields kibana#154013: Allows users to set the min and max file size by setting two new fields the kibana.yml file:
    • xpack.cases.files.allowedMimeTypes - An array of strings representing the allowed mime types to be attached to a case.
    • xpack.cases.files.maxSize - A number representing the file size limit for files being attached to a case (in bytes).
• [Cases] Link cases to alerts kibana#146864 and [RAM] Show Cases column on the alerts table kibana#150963: Users can add the Cases column to the Alerts table to view cases that alerts have been added to. This feature gives users an easy way to identify which cases certain alerts are being investigated in. Might be sufficient to doc this in the Kibana release notes only.
• [Cases] Paginate user actions kibana#130227 and [Cases] Paginate user actions kibana#130227: Case activity and history is paginated and can be sorted. Refer to #130227 for design and functionality details.
• [Cases] Make the alerts table in cases GA kibana#154626: Alerts table is GA in 8.8. Remove the warning note in the Examine alerts attached to a case section.
• [Cases] Update cases ids in the alerts schema when attaching an alert to a case kibana#147985: The privileges for attaching alerts to cases has changed. To attach alerts to cases, users now need Read access to Security, and Write access to the case. Need to do the following:
  • Might need to refresh the second row in the privs table in the Case prerequisites topic.
  • Possibly mention this breaking change in the Security release notes. It's currently doc'd in Kibana but might still need to mention in Security release notes because it's a change that directly affects Security cases.

Screenshots/flows to update

Minor UI updates to the case details page will affect screenshots and flows doc'd in the Open and manage cases topic:

• The new Files tab was added after the Alerts tab.
• The Alerts tab no longer has an icon after it.
• The case description is no longer part of the user history/activity thread.
• The user history/activity thread is preceded by three tabs:
  • All: Shows all comments and user activity/history.
  • Comments: Shows comments only.
  • History: Shows the case's full history (includes actions, case status, ??)

The following screenshots will need to be refreshed:
NOTE: First four were updated in https://github.com/elastic/security-docs/pull/3236/files.

• cases-ui-open.png
• cases-summary.png
• cases-manage-comments.png (not mandatory, but might be good to refresh anyways so it doesn't stick out from the other refreshed screenshots)
• cases-alert-tab.png
• add-vis-to-case.gif
• cases-open-vis.png (not mandatory but might stick out if refreshed other screenshot)

Update these flows:

• Add a bullet to the Manage existing cases list that describes the different ways that users can view case activity and history.

Follow-up

Check on the following:

• [BUG] Alerts can be deleted in the case history #3241
• Get PRs for UI updates to the case details page.
• Confirm what's included in a case's history. What will users see when they click the History tab?
• Clarify if write access = selecting the All setting for Cases. Currently, docs show that users need All privs for Cases.
• Might need to update case priv docs to show what Security privs cases need for each level of access. Addressing [BUG] Document required Security privs for cases  #3239 after 8.8.

Notes

• The following issues/PRs will likely only need release notes and will be doc'd in the Kibana release notes:
  • [Cases] Prevent users to attach the same alert to a case kibana#145514
  • [Cases] Update cases ids in the alerts schema when attaching an alert to a case kibana#147985 (this will be doc'd as a breaking change in Kibana but likely does not affect the user experience when they're interacting with Security cases.)

[lcawl]

FYI There's a breaking change in elastic/kibana#155951 related to elastic/kibana#147985 which I think means a new row should be added to https://www.elastic.co/guide/en/security/master/case-permissions.html. You can see the changes I've drafted for Kibana and Observability (e.g. elastic/observability-docs#2898)

[nastasha-solomon]

Thanks for the ping about this, @lcawl! I added a task for myself in the issue description to update the case priv docs and possibly the Security release notes (see last bullet in the "Changes to document" section).

cc: @jonathan-buttner @cnasikas