SIEM created and closed cases report

[christos.nasikas]

Hey @bnk

I managed to reproduce what you are saying. I think the problem is with the index pattern. You need to be a bit more specific with the index pattern. Mine was .kibana-*. I changed it to .kibana-nasikas_8.0.0 and it worked.

Steps to produce what you want:

1. Go to Stack Management -> Index Patterns
2. Click to Create index pattern and check Include system and hidden indices
3. Put as Index pattern name .kibana_<your_versions>. You don't want to inlude .kibana-task-manager and .kibana-event-log
4. Select @timestamp as the time field.
5. Go to Analytics -> Dashboard -> Create visualization
6. Select your index pattern

7. Adjust your time range to include the cases you want.

8. Search for the cases.status field name. It should be on the Available fields

9. Drag and drop the field to the right area

You should be able to see some diagrams with your data.

I hope that helps. Let me know if you need any help.

Best,
Christos