# SIEM created and closed cases report

**URL:** https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931
**Category:** SIEM
**Created:** [April 22, 2021, 7:46am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931 "2021-04-22T07:46:32Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)
#### Post date: [May 17, 2021, 12:40pm UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931/8 "2021-05-17T12:40:26Z")

</div>

Hey @bnk

I managed to reproduce what you are saying. I think the problem is with the index pattern. You need to be a bit more specific with the index pattern. Mine was `.kibana-*`. I changed it to `.kibana-nasikas_8.0.0` and it worked.

Steps to produce what you want:

1. Go to Stack Management -\> Index Patterns
2. Click to Create index pattern and check Include system and hidden indices
3. Put as Index pattern name `.kibana_<your_versions>`. You don't want to inlude `.kibana-task-manager` and `.kibana-event-log`
4. Select `@timestamp` as the time field.
5. Go to Analytics -\> Dashboard -\> Create visualization
6. Select your index pattern

 ![Screenshot 2021-05-17 at 3.36.48 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b86ebe9c24fad65bdad8d17d8a2fae4f1814ab68.png)

1. Adjust your time range to include the cases you want.

 ![Screenshot 2021-05-17 at 3.36.40 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/4/d40d4872c7726479680f945d3171d55a3728ec58.png)

1. Search for the `cases.status` field name. It should be on the Available fields

 ![Screenshot 2021-05-17 at 3.36.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/0/80597ae9041ce34c86b6537b2dfe25ddcce3d75d.png)

1. Drag and drop the field to the right area

 ![Screenshot 2021-05-17 at 3.39.41 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de2a33a3eb7ecb2496047a5414f6952f41ce0226.png)

You should be able to see some diagrams with your data.

I hope that helps. Let me know if you need any help.

Best,  
Christos

---

_[View the full topic](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931)._