I want to include information about open/closed cases in a custom KPI dashboard. I'm not seeing which index to pull that information from.
Does anyone know how I could locate that?
Just an update as I continue trying to get this data on my custom dashboard.
I found that records in the .internal.alerts-security* logs has a kibana.alert.case_ids that gets populated when an alert is added to a case.
Still working on the query, but I think I can dedup in ES|QL to get a count of cases. That will at least give me a count to review.