securityonion/salt/elasticsearch/templates/component/so/case-settings.json

{
  "template": {},
  "version": 1,
  "_meta": {
    "description": "default settings for common Security Onion Cases indices"
  }
}