# SIEM created and closed cases report **URL:** \ **Category:** SIEM\ **Created:** [April 22, 2021, 7:46am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931 "2021-04-22T07:46:32Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)\ **Post date:** [April 22, 2021, 7:46am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/1 "2021-04-22T07:46:32Z")
Hello, I looked information if there is a possibility to export info about created and closed cases (also tags associated with cases and other related info) in ELK SIEM, but I coudn't find any information. Is there a way to export information from SIEM section Cases? Regards Ema ---
**Author:** ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)\ **Post date:** [April 22, 2021, 5:35pm UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/2 "2021-04-22T17:35:29Z")
Hey Ema, Thanks for your question! The Cases plugin supports creating external incidents as described here: [Create or update an external incident | Elastic Security Solution [7.12] | Elastic](https://www.elastic.co/guide/en/security/current/cases-actions-api-execute.html#subaction-params-incident) Unfortunately beyond that we don't have a way to export Cases at the moment but it is something we're hoping to incorporate! Jonathan ---
**Author:** ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)\ **Post date:** [April 27, 2021, 11:15am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/3 "2021-04-27T11:15:32Z")
Thank you for your response. I am curious is there any way to create statistic chart, table or any other statistic visualization of open, closed cases within Elastic? Like dashboard or canvas? ---
**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\ **Post date:** [May 6, 2021, 9:06am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/4 "2021-05-06T09:06:37Z")
Hi @bnk It is not possible to do it through Cases. Nevertheless, there is a way to do it. You have to create the `.kibana*` index pattern and then go to canvas or dashboard and select the index pattern. Then you can filter like `cases.status: "closed"` and use a count metric or use the values from there to create visualizations. Be aware that this is a system index and that the data structures may not be very "dashboard friendly". Best, Christos ---
**Author:** ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)\ **Post date:** [May 13, 2021, 9:18am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/5 "2021-05-13T09:18:23Z")
Thank you @christos.nasikas for your response! With your guidance we have managed to create a dashboard for closed cases. In your suggested .kibana\* index, there are no info about "open" cases. Is there any way to include info or create new index about created and still open cases? Regards Ema ---
**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\ **Post date:** [May 13, 2021, 10:44am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/6 "2021-05-13T10:44:42Z")
Hey @bnk Cases at the moment support three statuses: `open`, `in-progress`, and `closed`. Have you tried to create the dashboard with `cases.status: "open"` ? ---
**Author:** ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)\ **Post date:** [May 13, 2021, 3:20pm UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/7 "2021-05-13T15:20:56Z")
I created filter with Controls visualization, where I can filter out whole dashboard "closed" and "open" cases , only one visualization in a dashboard shows "Open" case. That visualization was created with cases.created\_at field. Other visualizations do not show data at all. It seems that they count only "Closed" cases. For example, Metrics visualization (which counts sum of all cases) shows 0 open cases though where is 1. I edited it: aggregation is set to count, I've created a bucket with aggregation -\> Filter -\> cases.status :"open" -\> update. But result were the same, zero open cases . I think I am doing something wrong ☹ Regards Ema ---
**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\ **Post date:** [May 17, 2021, 12:40pm UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/8 "2021-05-17T12:40:26Z")
Hey @bnk I managed to reproduce what you are saying. I think the problem is with the index pattern. You need to be a bit more specific with the index pattern. Mine was `.kibana-*`. I changed it to `.kibana-nasikas_8.0.0` and it worked. Steps to produce what you want: 1. Go to Stack Management -\> Index Patterns 2. Click to Create index pattern and check Include system and hidden indices 3. Put as Index pattern name `.kibana_`. You don't want to inlude `.kibana-task-manager` and `.kibana-event-log` 4. Select `@timestamp` as the time field. 5. Go to Analytics -\> Dashboard -\> Create visualization 6. Select your index pattern ![Screenshot 2021-05-17 at 3.36.48 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b86ebe9c24fad65bdad8d17d8a2fae4f1814ab68.png) 1. Adjust your time range to include the cases you want. ![Screenshot 2021-05-17 at 3.36.40 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/4/d40d4872c7726479680f945d3171d55a3728ec58.png) 1. Search for the `cases.status` field name. It should be on the Available fields ![Screenshot 2021-05-17 at 3.36.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/0/80597ae9041ce34c86b6537b2dfe25ddcce3d75d.png) 1. Drag and drop the field to the right area ![Screenshot 2021-05-17 at 3.39.41 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de2a33a3eb7ecb2496047a5414f6952f41ce0226.png) You should be able to see some diagrams with your data. I hope that helps. Let me know if you need any help. Best, Christos ---
**Author:** ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)\ **Post date:** [May 19, 2021, 8:23am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/9 "2021-05-19T08:23:41Z")
Thank you @christos.nasikas for detailed answer. After I wrote a comment, I started analyzing .kibana-\* index and I determined that the problem was in the index. Thanks you once again, I managed to create a dashboard where I see all cases (open and closed). Best Regards Ema ---
**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\ **Post date:** [May 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/10 "2021-05-19T09:53:21Z")
You are welcome! I am glad that you managed to create your dashboards. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2021, 9:53am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/11 "2021-06-16T09:53:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.