How to track cases in a dashboard?

[elasticfran (fran)]

Hello there!

Is there a way to track cases in a dashboard?

Like having a panel for:

1. open cases
2. cases in progress
3. pending cases
4. new cases

Tried the tutorial:

Cases | Elastic Security Solution [7.15] | Elastic

but i happen not to have the option "add a les" visualization.

Thanks!

[christos.nasikas]

Hi @elasticfran,

The "add lens" feature allows you to add dashboards in Cases. It was introduced in 7.15.

At the moment is not possible to create a dashboard from within Cases. It is in our roadmap to support it in the future. There is a way to do it using the .kibana system index. Be aware that
the data structures of a system index may not be very "dashboard friendly" and they are subject to change in the future.

Steps:

1. Go to Stack Management -> Index Patterns.
2. Click to Create index pattern and check Include system and hidden indices.
3. Put as Index pattern name .kibana_<your_version> . You don't want to inlude .kibana-task-manager and .kibana-event-log
4. Select @timestamp or updated_at as the time field.
5. Go to Analytics -> Dashboard -> Create visualization
6. Select your index pattern
7. Adjust your time range to include the cases you want.
8. On the Available fields you can search for cases fields. To visualize open, in progress, closed cases use the cases.status field. For new cases the cases.created_at field etc.

9. Drag and drop the field to the visualization area (on the right). You should be able to see some visualizations.

Let me know if you need any help.

Reference: SIEM created and closed cases report - #8 by christos.nasikas

Best,
Christos