diff --git a/docs/serverless/images/cases-settings/security-cases-custom-fields.png b/docs/serverless/images/cases-settings/security-cases-custom-fields.png
deleted file mode 100644
index 8fdf1221204..00000000000
Binary files a/docs/serverless/images/cases-settings/security-cases-custom-fields.png and /dev/null differ
diff --git a/docs/serverless/investigate/cases-open-manage.mdx b/docs/serverless/investigate/cases-open-manage.mdx
deleted file mode 100644
index ee6be386770..00000000000
--- a/docs/serverless/investigate/cases-open-manage.mdx
+++ /dev/null
@@ -1,271 +0,0 @@
----
-slug: /serverless/security/cases-open-manage
-title: Create and manage cases
-description: Create a case in ((elastic-sec)), and add files and visualizations.
-tags: ["serverless","security","how-to","analyze","manage"]
-status: in review
----
-
-
-
-
-You can create and manage cases using the UI or the [Cases API](((security-guide))/cases-api-overview.html).
-{/* Link to classic docs until serverless API docs are available. */}
-
-
-
-## Open a new case
-
-Open a new case to keep track of security issues and share their details with
-colleagues.
-
-1. Go to **Cases**, then click **Create case**. If no cases exist, the Cases table will be empty and you'll be prompted to create one by clicking the **Create case** button inside the table.
-1. (Optional) If you defined templates, select one to use its default field values.
-1. Give the case a name, assign a severity level, and provide a description. You can use
- [Markdown](https://www.markdownguide.org/cheat-sheet) syntax in the case description.
-
-
- If you do not assign your case a severity level, it will be assigned **Low** by default.
-
-
-
- You can insert a Timeline link in the case description by clicking the Timeline icon ().
-
-
-1. Optionally, add a category, assignees and relevant tags. You can add users only if they meet the necessary prerequisites.
-1. If you defined custom fields, they appear in the **Additional fields** section.
-1. Choose if you want alert statuses to sync with the case's status after they are added to the case. This option is enabled by default, but you can turn it off after creating the case.
-1. From **External incident management**, select a connector. If you've previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`.
-1. Click **Create case**.
-
-
- If you've selected a connector for the case, the case is automatically pushed to the third-party system it's connected to.
-
-
-
-{/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-
-
-{/*
-This functionality does not exist yet in serverless.
-To be updated: references to Kibana, ESS. Once this section is added back in, edit the frontmatter description back to: Create a case in ((elastic-sec)), configure email notifications, and add files and visualizations.
-
-## Add email notifications
-
-You can configure email notifications that occur when users are assigned to cases.
-
-For hosted ((kib)) on ((ess)):
-
-1. Add the email addresses to the monitoring email allowlist. Follow the steps in
- [Send alerts by email](((cloud))/ec-watcher.html#ec-watcher-allowlist).
-
- You do not need to take any more steps to configure an email connector or update
- ((kib)) user settings, since the preconfigured Elastic-Cloud-SMTP connector is
- used by default.
-
-For self-managed ((kib)):
-
-1. Create a preconfigured email connector.
-
-
- At this time, email notifications support only [preconfigured email connectors](((kibana-ref))/pre-configured-connectors.html),
- which are defined in the `kibana.yml` file.
-
-
-1. Set the `notifications.connectors.default.email` ((kib)) setting to the name of
- your email connector.
-
-1. If you want the email notifications to contain links back to the case, you
- must configure the [server.publicBaseUrl](((kibana-ref))/settings.html#server-publicBaseUrl) setting.
-
-When you subsequently add assignees to cases, they receive an email.
-
- */}
-
-## Manage existing cases
-
-From the Cases page, you can search existing cases and filter them by attributes such as assignees, categories, severity, status, and tags. You can also select multiple cases and use bulk actions to delete cases or change their attributes. General case metrics, including how long it takes to close cases, are provided above the table.
-
-
-{/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-To explore a case, click on its name. You can then:
-
-* Review the case summary
-* Add and manage comments
-
-
- Comments can contain Markdown. For syntax help, click the Markdown icon () in the bottom right of the comment.
-
-
-* Examine alerts and indicators attached to the case
-* Add files
-* Add a Lens visualization
-* Modify the case's description, assignees, category, severity, status, and tags.
-* Manage connectors and send updates to external systems (if you've added a connector to the case)
-* Copy the case UUID
-* Refresh the case to retrieve the latest updates
-
-
-
-### Review the case summary
-
-Click on an existing case to access its summary. The case summary, located under the case title, contains metrics that summarize alert information and response times. These metrics update when you attach additional unique alerts to the case, add connectors, or modify the case's status:
-
-* **Total alerts**: Total number of unique alerts attached to the case
-* **Associated users**: Total number of unique users that are represented in the attached alerts
-* **Associated hosts**: Total number of unique hosts that are represented in the attached alerts
-* **Total connectors**: Total number of connectors that have been added to the case
-* **Case created**: Date and time that the case was created
-* **Open duration**: Time elapsed since the case was created
-* **In progress duration**: How long the case has been in the `In progress` state
-* **Duration from creation to close**: Time elapsed from when the case was created to when it was closed
-
-
-
-
-
-### Manage case comments
-To edit, delete, or quote a comment, select the appropriate option from the **More actions** menu ().
-
-
-
-
-
-### Examine alerts attached to a case
-
-To explore the alerts attached to a case, click the **Alerts** tab. In the table, alerts are organized from oldest to newest. To view alert details, click the **View details** button.
-
-
-
-
-Each case can have a maximum of 1,000 alerts.
-
-
-
-
-### Add files
-
-To upload files to a case, click the **Files** tab:
-
-
-{/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-You can add images and text, CSV, JSON, PDF, or ZIP files.
-For the complete list, check [mime_types.ts](https://github.com/elastic/kibana/blob/main/x-pack/plugins/cases/common/constants/mime_types.ts).
-
-
-There is a 10 MiB size limit for images. For all other MIME types, the limit is 100 MiB.
-
-
-To download or delete the file, or copy the file hash to your clipboard, open the **Actions** menu (**…**).
-The available hash functions are MD5, SHA-1, and SHA-256.
-
-When you add a file, a comment is added to the case activity log.
-To view an image, click its name in the activity or file list.
-
-
-
-### Add a Lens visualization
-
-
-Add a Lens visualization to your case to portray event and alert data through charts and graphs.
-
-
-
-To add a Lens visualization to a comment within your case:
-
-1. Click the **Visualization** button. The **Add visualization** dialog appears.
-1. Select an existing visualization from your Visualize Library or create a new visualization.
-
-
- Set an absolute time range for your visualization. This ensures your visualization doesn't change over time after you save it to your case, and provides important context for others managing the case.
-
-
-1. Save the visualization to your Visualize Library by clicking the **Save to library** button (optional).
- 1. Enter a title and description for the visualization.
- 1. Choose if you want to keep the **Update panel on Security** activated. This option is activated by default and automatically adds the visualization to your Visualize Library.
-1. After you've finished creating your visualization, click **Save and return** to go back to your case.
-1. Click **Preview** to show how the visualization will appear in the case comment.
-1. Click **Add Comment** to add the visualization to your case.
-
-Alternatively, while viewing a dashboard you can open a panel's menu then click **More actions** () → **Add to existing case** or **More actions** () → **Add to new case**.
-
-After a visualization has been added to a case, you can modify or interact with it by clicking the **Open Visualization** option in the case's comment menu.
-
-
-
-
-
-### Copy the case UUID
-
-Each case has a universally unique identifier (UUID) that you can copy and share. To copy a case's UUID to a clipboard, go to the Cases page and select **Actions** → **Copy Case ID** for the case you want to share. Alternatively, go to a case's details page, then from the **More actions** menu (), select **Copy Case ID**.
-
-
-
-
-
-## Export and import cases
-
-Cases can be exported and imported as saved objects using the Saved Objects project settings UI.
-
-
-Before importing Lens visualizations, Timelines, or alerts, ensure their data is present. Without it, they won't work after being imported.
-
-
-
-
-### Export a case
-Use the **Export** option to move cases between different ((elastic-sec)) instances. When you export a case, the following data is exported to a newline-delimited JSON (`.ndjson`) file:
-
-* Case details
-* User actions
-* Text string comments
-* Case alerts
-* Lens visualizations (exported as JSON blobs).
-
-
-
-The following attachments are _not_ exported:
-
-* **Case files**: Case files are not exported. However, they are accessible in **Project settings** → **Management** → **Files** to download and re-add.
-* **Alerts**: Alerts attached to cases are not exported. You must re-add them after importing cases.
-
-
-
-To export a case:
-
-1. Go to **Project settings** → **Management** → **Saved objects**.
-1. Search for the case by choosing a saved object type or entering the case title in the search bar.
-1. Select one or more cases, then click the **Export** button.
-1. Click **Export**. A confirmation message that your file is downloading displays.
-
-
- Keep the **Include related objects** option enabled to ensure connectors are exported too.
-
-
-
-
-
-
-### Import a case
-
-To import a case:
-
-1. Go to **Project settings** → **Management** → **Saved objects**.
-1. Click **Import**.
-1. Select the NDJSON file containing the exported case and configure the import options.
-1. Click **Import**.
-1. Review the import log and click **Done**.
-
-
-
- Be mindful of the following:
-
- * If the imported case had connectors attached to it, you'll be prompted to re-authenticate the connectors. To do so, click **Go to connectors** on the **Import saved objects** flyout and complete the necessary steps. Alternatively, open the main menu, then go to **Project settings** → **Management** → **((connectors-ui))** to access connectors.
-
- * If the imported case had attached alerts, verify that the alerts' source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts' source documents to function.
-
-
-
diff --git a/docs/serverless/investigate/cases-settings.mdx b/docs/serverless/investigate/cases-settings.mdx
deleted file mode 100644
index 91aea823906..00000000000
--- a/docs/serverless/investigate/cases-settings.mdx
+++ /dev/null
@@ -1,166 +0,0 @@
----
-slug: /serverless/security/cases-settings
-title: Configure case settings
-description: Change the default behavior of ((security)) cases by adding connectors, custom fields, templates, and closure options.
-tags: [ 'serverless', 'security', 'how-to', 'configure' ]
-status: in review
----
-
-
-
-To access case settings in a ((security)) project, go to **Cases** → **Settings**.
-
-
-{/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-## Case closures
-
-If you close cases in your external incident management system, the cases will remain open in ((elastic-sec)) until you close them manually.
-
-To close cases when they are sent to an external system, select **Automatically close Security cases when pushing new incident to external system**.
-
-## External incident management systems
-
-You can push ((elastic-sec)) cases to these third-party systems:
-
-* ((sn-itsm))
-* ((sn-sir))
-* ((jira)) (including Jira Service Desk)
-* ((ibm-r))
-* ((swimlane))
-* ((webhook-cm))
-
-To push cases, you need to create a connector, which stores the information required to interact with an external system. After you have created a connector, you can set ((elastic-sec)) cases to automatically close when they are sent to external systems.
-
-
-To create connectors and send cases to external systems, you need the Security Analytics Complete and the appropriate user role. For more information, refer to Cases prerequisites.
-
-
-To create a new connector
-
-1. From the **Incident management system** list, select **Add new connector**.
-
-1. Select the system to send cases to: **((sn))**, **((jira))**, **((ibm-r))**, **((swimlane))**, or **((webhook-cm))**.
- 
- {/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-1. Enter your required settings. For connector configuration details, refer to:
- - [((sn-itsm)) connector](((kibana-ref))/servicenow-action-type.html)
- - [((sn-sir)) connector](((kibana-ref))/servicenow-sir-action-type.html)
- - [((jira)) connector](((kibana-ref))/jira-action-type.html)
- - [((ibm-r)) connector](((kibana-ref))/resilient-action-type.html)
- - [((swimlane)) connector](((kibana-ref))/swimlane-action-type.html)
- - [((webhook-cm)) connector](((kibana-ref))/cases-webhook-action-type.html)
-
-To change the settings of an existing connector:
-
-1. Select the required connector from the incident management system list.
-1. Click **Update \**.
-1. In the **Edit connector** flyout, modify the connector fields as required, then click **Save & close** to save your changes.
-
-To change the default connector used to send cases to external systems, select the required connector from the incident management system list.
-
-### Mapped case fields
-
-When you export an ((elastic-sec)) case to an external system, case fields are mapped to existing fields in ((sn)), ((jira)), ((ibm-r)), and ((swimlane)). For the ((webhook-cm)) connector, case fields can be mapped to custom or pre-existing fields in the external system you're connecting to.
-
-Once fields are mapped, you can push updates to external systems, and mapped fields are overwritten or appended. Retrieving data from external systems is not supported.
-
-
-
-
- Title
-
-
-
-
- The case `Title` field is mapped to corresponding fields in external systems. Mapped field values are overwritten when you push updates.
-
- * **((sn))**: `Short description`
- * **((jira))**: `Summary`
- * **((ibm-r))**: `Name`
- * **((swimlane))**: `Description`
-
-
-
-
-
-
-
- Description
-
-
-
- The case `Description` field is mapped to the `Description` field in all systems. Mapped field values are overwritten when you push updates.
-
-
-
-
-
-
- Comments
-
-
-
-
- The case `Comments` field is mapped to corresponding fields in external systems.
-
- * **((sn))**: `Work Notes`
- * **((jira))**: `Comments`
- * **((ibm-r))**: `Comments`
- * **((swimlane))**: `Comments`
-
-
- New and edited comments are added to incident records when pushed to ((sn)), ((jira)), or ((ibm-r)). Comments pushed to ((swimlane)) are appended to the `Comment` field in ((swimlane)) and posted individually.
-
-
-
-
-
-
-## Custom fields
-
-You can add optional and required fields for customized case collaboration.
-
-1. In the **Custom fields** section, click **Add field**.
- 
- {/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-1. You must provide a field label and type (text or toggle).
- You can optionally designate it as a required field and provide a default value.
-
-When you create a custom field, it's added to all new and existing cases.
-In existing cases, new custom text fields initially have null values.
-
-You can subsequently remove or edit custom fields on the **Settings** page.
-
-## Templates
-
-
-
-You can make the case creation process faster and more consistent by adding templates.
-A template defines values for one or all of the case fields (such as severity, tags, description, and title) as well as any custom fields.
-
-To create a template:
-
-1. In the **Templates** section, click **Add template**.
-
- 
- {/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
-
-1. You must provide a template name and case severity. You can optionally add template tags and a description, values for each case field, and a case connector.
-
-When users create cases, they can optionally select a template and use its field values or override them.
-
-
-If you update or delete templates, existing cases are unaffected.
-
\ No newline at end of file