Case custom fields GA

docs/cases/cases-manage-settings.asciidoc

@@ -11,10 +11,7 @@ To change case closure options and add custom fields, templates, and connectors
 image::images/cases-settings.png[Shows the case settings page]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-* <<close-sent-cases,Set case closure options>>.
-* <<cases-ui-integrations,Add connectors for external incident management systems>>.
-* <<cases-ui-custom-fields,Add custom fields>>.
-* <<cases-templates,Add templates>>.
+NOTE: To view and change case settings, you must have the appropriate {kib} feature privileges. Refer to <<case-permissions>>.
 
 [[close-connector]]
 [float]
@@ -104,6 +101,28 @@ New and edited comments are added to incident records when pushed to {sn}, {jira
 
 |===
 
+[float]
+[[cases-ui-custom-fields]]
+=== Custom fields
+
+You can add optional and required fields for customized case collaboration.
+
+. In the *Custom fields* section, click *Add field*.
++
+--
+[role="screenshot"]
+image::images/cases-add-custom-field.png[Add a custom field in case settings]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+--
+
+. You must provide a field label and type (text or toggle).
+  You can optionally designate it as a required field and provide a default value.
+
+When you create a custom field, it's added to all new and existing cases.
+In existing cases, new custom text fields initially have null values.
+
+You can subsequently remove or edit custom fields on the **Settings** page.
+
 [float]
 [[cases-templates]]
 === Templates

docs/cases/cases-manage.asciidoc

@@ -43,46 +43,6 @@ NOTE: If you've selected a connector for the case, the case is automatically pus
 image::images/cases-ui-open.png[Shows an open case]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-[float]
-[[cases-ui-custom-fields]]
-== Add custom fields
-
-preview::[]
-
-You can add optional and required fields for customized case collaboration.
-
-. Go to *Cases* and click *Settings*.
-+
---
-[role="screenshot"]
-image::images/cases-custom-field-settings.png[View custom fields in case settings]
-// NOTE: This is an autogenerated screenshot. Do not edit it directly.
-
-NOTE: To view and change case settings, you must have the appropriate {kib} feature privileges. Refer to <<case-permissions>>.
---
-
-. In the *Custom fields* section, click *Add field*.
-+
---
-[role="screenshot"]
-image::images/cases-add-custom-field.png[Add a custom field in case settings]
-// NOTE: This is an autogenerated screenshot. Do not edit it directly.
---
-
-. Enter a field label.
-
-. Choose a field type: text or toggle.
-
-. (Optional) To make the text field mandatory, select *Make this field required*.
-
-. (Optional) Add a default value.
-
-. Click *Save field*.
-
-After you create custom fields, they're added to all new and existing cases.
-Existing cases have null values for the new text fields until you set them.
-To manage custom fields, go to the *Settings* page and remove or edit them.
-
 [float]
 [[cases-ui-notifications]]
 == Add email notifications

docs/serverless/investigate/cases-open-manage.mdx

@@ -20,7 +20,7 @@ Open a new case to keep track of security issues and share their details with
 colleagues.
 
 1. Go to **Cases**, then click **Create case**. If no cases exist, the Cases table will be empty and you'll be prompted to create one by clicking the **Create case** button inside the table.
-1. (Optional) If you defined <DocLink slug="/serverless/security/cases-settings">templates</DocLink>, select one to use its default field values. <DocBadge template="technical preview" />
+1. (Optional) If you defined <DocLink slug="/serverless/security/cases-settings" section="templates">templates</DocLink>, select one to use its default field values. <DocBadge template="technical preview" />
 1. Give the case a name, assign a severity level, and provide a description. You can use
     [Markdown](https://www.markdownguide.org/cheat-sheet) syntax in the case description.
 
@@ -33,7 +33,7 @@ colleagues.
     </DocCallOut>
 
 1. Optionally, add a category, assignees and relevant tags. You can add users only if they meet the necessary <DocLink slug="/serverless/security/cases-requirements">prerequisites</DocLink>.
-
+1. If you defined <DocLink slug="/serverless/security/cases-settings" section="custom-fields">custom fields</DocLink>, they appear in the **Additional fields** section.
 1. Choose if you want alert statuses to sync with the case's status after they are added to the case. This option is enabled by default, but you can turn it off after creating the case.
 1. From **External incident management**, select a <DocLink slug="/serverless/security/cases-settings">connector</DocLink>. If you've previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`.
 1. Click **Create case**.

docs/serverless/investigate/cases-settings.mdx

@@ -138,6 +138,22 @@ Once fields are mapped, you can push updates to external systems, and mapped fie
   </DocRow>
 </DocTable>
 
+## Custom fields
+
+You can add optional and required fields for customized case collaboration.
+
+1. In the **Custom fields** section, click **Add field**.
+   ![Add a custom field](../images/cases-settings/security-cases-custom-fields.png)
+   {/* NOTE: This is an autogenerated screenshot. Do not edit it directly. */}
+
+1. You must provide a field label and type (text or toggle).
+   You can optionally designate it as a required field and provide a default value.
+
+When you create a custom field, it's added to all new and existing cases.
+In existing cases, new custom text fields initially have null values.
+
+You can subsequently remove or edit custom fields on the **Settings** page.
+
 ## Templates
 
 <DocCallOut template="technical_preview" />