# Security Case Data for Custom Dashboard
**URL:** https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973
**Category:** SIEM
**Created:** [September 3, 2024, 3:06pm UTC](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973 "2024-09-03T15:06:12Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [September 3, 2024, 3:06pm UTC](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973/1 "2024-09-03T15:06:12Z")
I want to include information about open/closed cases in a custom KPI dashboard. I'm not seeing which index to pull that information from.
Does anyone know how I could locate that?
---
### Author:  [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [September 5, 2024, 12:34pm UTC](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973/2 "2024-09-05T12:34:54Z")
Just an update as I continue trying to get this data on my custom dashboard.
I found that records in the .internal.alerts-security\* logs has a kibana.alert.case\_ids that gets populated when an alert is added to a case.
Still working on the query, but I think I can dedup in ES|QL to get a count of cases. That will at least give me a count to review.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 3, 2024, 12:35pm UTC](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973/3 "2024-10-03T12:35:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.