- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Is there a way to create custom use case categories within the use case library for ES?
The out-of-the-box categories look fairly rigid:
Abuse, Adversary Tactics, Best Practices, Cloud Security, Compliance, Malware, Vulnerability, etc.
Some SOC users are asking if this is possible without doing crazy XML file changes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I believe if you create your custom searches with categories in local/analytic_stories.conf and analyticsstories.conf [ try to mimic same pattern as in default] and supplement with related savedsearches/correlationsearches.conf, the dashboards should be able to use them.
Additionally, you can also send feedback via the app for them to take a note and advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I believe if you create your custom searches with categories in local/analytic_stories.conf and analyticsstories.conf [ try to mimic same pattern as in default] and supplement with related savedsearches/correlationsearches.conf, the dashboards should be able to use them.
Additionally, you can also send feedback via the app for them to take a note and advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey Lakshman,
Thanks for the feedback. I was able to create a custom category through editing those two.conf files related to analytic stories. I also requested a future enhancement to app developers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Glad it helped.Pls accept if you are satisfied to close this thread.
