[Feature Request][Security Cases] Bulk Status Updates

[kayapuskarov]

Describe the feature:

Provide a way for the users to be able to various bulk actions of multiple cases at once.

Describe a specific use case for the feature:

• We could have multiple cases that need to be closed all at once and it would be more efficient if there was a bulk action that could make that accomplished.
• We could have multiple cases that need to be given or removed a tag.
• We could have multiple cases that need to be re-opened
• We could have multiple cases that need to be assigned to a specific user
• We could have multiple cases to which we want to add the same comment

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)

[cnasikas]

Hi! PRs #142150, #142826, and #143450 added the ability to open, mark as in progress, close, change the severity, and edit tags of multiple cases. Soon we will start working on editing assignees to multiple cases. About adding the same comment to multiple cases, what is the use case?

[cnasikas]

PR #146907 added the ability to edit assignees on multiple cases. @kayapuskarov About adding the same comment to multiple cases, what is the use case?

[cnasikas]

@kayapuskarov Any update on this?

[kayapuskarov]

Hi @cnasikas Sorry for the late reply. I somehow missed this and I apologize.
The use case would be when there are multiple cases that are related to the same event and if there are findings in the investigations that relate to the cases in question, it might be helpful to add comments in a bulk. However, if it is possible to relate several cases into one, then I assume if it's possible to comment on the case that merged the other ones, then that should be enough.

[cnasikas]

No worries! It is easy to miss it if not pinged (my mistake) 🙂. From the above, which user flow makes more sense to you?

[kayapuskarov]

To me it makes more sense to be able to merge several cases into one and just comment on that one case.

[cnasikas]

Perfect! Then do you mind if I close this issue and focus on merging several cases into one?

[kayapuskarov]

not at all! sounds good to me!

[kayapuskarov]

and of course, thanks for your work!