Skip to content

Commit 1765614

Browse files
nastasha-solomonnastasha-solomon
committed
adds some content from toi
1 parent a49dd72 commit 1765614

File tree

5 files changed

+79
-69
lines changed

5 files changed

+79
-69
lines changed

‎explore-analyze/alerts-cases/cases.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,7 @@ If you create cases in the {{observability}} or {{security-app}}, they are not v
2727
* [Configure access to cases](cases/setup-cases.md)
2828
* [Open and manage cases](cases/manage-cases.md)
2929
* [Configure case settings](cases/manage-cases-settings.md)
30-
31-
32-
::::{note}
33-
{applies_to}`stack: ga 9.2` With the appropriate index access, you can [build visualizations and metrics](../../explore-analyze/alerts-cases/cases/visualize-case-data.md) of data in {{observability}}, {{stack-manage-app}}, and {{elastic-sec}} cases. This can provide improved visibility into patterns and trends of cases within your space.
34-
::::
30+
* {applies_to}`stack: preview 9.2`[Use cases as data](cases/cases-as-data.md)
3531

3632
## Limitations [kibana-case-limitations]
3733

‎explore-analyze/alerts-cases/cases/visualize-case-data.md‎ renamed to ‎explore-analyze/alerts-cases/cases/cases-as-data.md‎

Lines changed: 70 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,47 @@
11
---
22
applies_to:
3-
stack: ga 9.2
4-
serverless: ga
5-
products:
6-
- id: kibana
3+
deployment:
4+
ess: preview 9.2
5+
ece: preview 9.2
76
---
87

9-
# Visualize case data [visualize-case-data]
8+
# Use cases as data [use-cases-as-data]
109

11-
Case data, such as details about comments, activities, and attachments, is collected in case analytics indices. You can query these indices to build dashboards and metrics that improve your visibility into case patterns and trends.
10+
The cases as data feature lets you visualize data about cases in your [space](/deploy-manage/manage-spaces.md). After turning it on, you can query case data from dedicated case analytics indices and build dashboards and visualizations to track case trends and operational metrics. This information is particularly useful when reporting on key performance indicators (KPIs) such as Mean Time To Respond (MTTR), case severity trends, and analyst workload.
1211

13-
::::{admonition} Requirements
14-
15-
To visualize case data, you must do the following:
12+
## Turn on cases as data [turn-on-cases-as-data]
1613

17-
* {applies_to}`stack: ga` Turn on the case analytics indices feature by adding `xpack.cases.incrementalId.enabled: true` to your [`kibana.yml`](/deploy-manage/stack-settings.md) file.
18-
* Ensure your role has at least `read` and `view_index_metadata` access to the appropriate case anlaytics indices.
19-
* (Optional) If you don't have cases, create a new one in a {{kib}} space to automatically generate the case analytics indices.
14+
To turn on cases as data, add `xpack.cases.incrementalId.enabled: true` to your [`kibana.yml`](/deploy-manage/stack-settings.md) file.
2015

16+
::::{warning}
17+
3 tasks will be created that each execute in 5 minute interval. If you have lots of spaces with cases (for example, dozens), we do not reccomend enabling this feature as it will clog up task manager.
2118
::::
2219

23-
## About case analytics indices [about-case-analytics-indices]
20+
## Create and manage indices for case data [create-manage-case-analytics-indices]
2421

25-
After turning on the case analytics indices feature, your {{kib}} spaces are checked for case data. {{es}} automatically creates case analytics indices for Stack Management, {{observability}}, and Security in each {{kib}} space that has cases. {{es}} automatically creates aliases for the case analytics indices as well.
22+
After turning on cases as data, you do not need to manually create the analytics indices. {{es}} automatically creates the indices in any space with cases and for each solution ({{stack-manage-app}}, {{observability}}, and Security cases). To form the analytics indices, it indexes general data about cases and data related to case comments, attachments, and activity.
2623

27-
The case analytics indices are updated very five minutes with a snapshot of most current cases data in your spaces. Historical data for cases is not stored; it gets overwritten whenever the indices are refreshed.
24+
You also do not need to manually manage the analytics indices' index lifecycle management (ILM) policies. The indices are updated by a background task that runs every five minutes and applies a snapshot of the most current cases data. Note that historical case data is not retained; it gets overwritten whenever the indices are refreshed.
2825

2926
::::{note}
30-
It may take up to an hour for case analytics indices to form in a new {{kib}} space.
27+
After you create cases, {{es}} may take up to 10 minutes to index the new case data. If you create a new space, it can take up to an hour for new case analytics indices to form.
3128
::::
3229

33-
### General case data
34-
35-
These indices store general data related to cases created in Stack Management, {{observability}}, and Security.
36-
37-
| Index | Alias | Created for |
38-
| ---------------------------- | ---------------------- |----------------------------------------- |
39-
| `.internal.cases.<space-name>-cases` | `.cases.<space-name>-cases` | Stack Management cases |
40-
| `.internal.cases.<space-name>-observability` | `.cases.<space-name>-observability` | {{observability}} cases |
41-
| `.internal.cases.<space-name>-securitysolution` | `.cases.<space-name>-securitysolution` | Security cases |
42-
43-
### Case comments
44-
45-
These indices store data related to comments in Stack Management, {{observability}}, and Security cases.
46-
47-
| Index | Alias | Created for |
48-
| ---------------------------- | ---------------------- |----------------------------------------- |
49-
| `.internal.cases-comments.<space-name>-cases` | `.cases-comments.<space-name>-cases` | Stack Management cases |
50-
| `.internal.cases-comments.<space-name>-observability` | `.cases-comments.<space-name>-observability` | {{observability}} cases |
51-
| `.internal.cases-comments.<space-name>-securitysolution` | `.cases-comments.<space-name>-securitysolution` | Security cases |
52-
30+
## Explore case data [understand-case-analytics-indices]
5331

54-
### Case attachments
55-
56-
These indices store data related to attachments in Stack Management, {{observability}}, and Security cases.
57-
58-
| Index | Alias | Created for |
59-
| ---------------------------- | ---------------------- |----------------------------------------- |
60-
| `.internal.cases-attachments.<space-name>-cases` | `.cases-attachments.<space-name>-cases` | Stack Management cases |
61-
| `.internal.cases-attachments.<space-name>-observability` | `.cases-attachments.<space-name>-observability` | {{observability}} cases |
62-
| `.internal.cases-attachments.<space-name>-securitysolution` | `.cases-attachments.<space-name>-securitysolution` | Security cases |
63-
64-
### Case activity
32+
::::{admonition} Requirements
6533

66-
These indices store data related to activity in Stack Management, {{observability}}, and Security cases.
34+
* Your role has at least `read` and `view_index_metadata` access to the appropriate [case anlaytics indices](/explore-analyze/alerts-cases.md/cases/cases-as-data.md#case-analytics-indices).
35+
* You must have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.
6736

68-
| Index | Alias | Created for |
69-
| ---------------------------- | ---------------------- |----------------------------------------- |
70-
| `.internal.cases-activity.<space-name>-cases` | `.cases-activity.<space-name>-cases` | Stack Management cases |
71-
| `.internal.cases-activity.<space-name>-observability` | `.cases-activity.<space-name>-observability` | {{observability}} cases |
72-
| `.internal.cases-activity.<space-name>-securitysolution` | `.cases-activity.<space-name>-securitysolution` | Security cases |
37+
::::
7338

39+
To explore case data:
7440

75-
## Explore case data [explore-case-analytics-indices]
41+
1. Create a [data view](/explore-analyze/find-and-organize/data-views.md) that uses any of the [case analytics indices](/explore-analyze/alerts-cases/cases/cases-as-data.md#case-analytics-indices).
42+
2. Search and filter the case data in [Discover](../../discover.md) or build visualizations for dashboards in [Lens](../../visualize/lens.md).
7643

77-
Search and filter case data in [Discover](../../discover.md) and [Lens](../../visualize/lens.md), and build visualizations for [dashboards](../../dashboards.md). To help you start visualizing your case data, here are some sample {{esql}} queries that you can run from the [{{esql}} editor](../../../explore-analyze/query-filter/languages/esql-kibana.md#esql-kibana-get-started) in Discover.
44+
To help you start visualizing your case data, here are some sample {{esql}} queries that you can run from the [{{esql}} editor](../../../explore-analyze/query-filter/languages/esql-kibana.md#esql-kibana-get-started) in Discover.
7845

7946
* Find the total number of open cases in the default {{kib}} space:
8047

@@ -106,7 +73,51 @@ Search and filter case data in [Discover](../../discover.md) and [Lens](../../vi
10673
FROM .internal.cases.default-securitysolution | STATS average_time_to_close = AVG(time_to_resolve)
10774
```
10875

109-
::::{tip}
110-
To learn more about queryable fields in the indices, refer to
111-
% [Case analytics indices schema](kibana://reference/case-analytics-indices-schema.md)
112-
::::
76+
## Case analytics indices names and aliases
77+
78+
This section provides the names and aliases of the case analytics indices that {{es}} creates per space and solution. Note that `<space-name>` is a placeholder for the name of a space.
79+
80+
::::{note}
81+
Go to
82+
% [Case analytics indices schema](kibana://reference/case-analytics-indices-schema.md) for schema details.
83+
::::
84+
85+
### Indices for general case data
86+
87+
These indices store general data about cases.
88+
89+
| Index | Alias | Created for |
90+
| ---------------------------- | ---------------------- |----------------------------------------- |
91+
| `.internal.cases.<space-name>-cases` | `.cases.<space-name>-cases` | Stack Management cases |
92+
| `.internal.cases.<space-name>-observability` | `.cases.<space-name>-observability` | {{observability}} cases |
93+
| `.internal.cases.<space-name>-securitysolution` | `.cases.<space-name>-securitysolution` | Security cases |
94+
95+
### Indices for case comments
96+
97+
These indices store data related to comments in Stack Management, {{observability}}, and Security cases.
98+
99+
| Index | Alias | Created for |
100+
| ---------------------------- | ---------------------- |----------------------------------------- |
101+
| `.internal.cases-comments.<space-name>-cases` | `.cases-comments.<space-name>-cases` | Stack Management cases |
102+
| `.internal.cases-comments.<space-name>-observability` | `.cases-comments.<space-name>-observability` | {{observability}} cases |
103+
| `.internal.cases-comments.<space-name>-securitysolution` | `.cases-comments.<space-name>-securitysolution` | Security cases |
104+
105+
### Indices for case attachments
106+
107+
These indices store data related to attachments in Stack Management, {{observability}}, and Security cases.
108+
109+
| Index | Alias | Created for |
110+
| ---------------------------- | ---------------------- |----------------------------------------- |
111+
| `.internal.cases-attachments.<space-name>-cases` | `.cases-attachments.<space-name>-cases` | Stack Management cases |
112+
| `.internal.cases-attachments.<space-name>-observability` | `.cases-attachments.<space-name>-observability` | {{observability}} cases |
113+
| `.internal.cases-attachments.<space-name>-securitysolution` | `.cases-attachments.<space-name>-securitysolution` | Security cases |
114+
115+
### Indices for case activity [case-activity-indices]
116+
117+
These indices store data related to activity in Stack Management, {{observability}}, and Security cases.
118+
119+
| Index | Alias | Created for |
120+
| ---------------------------- | ---------------------- |----------------------------------------- |
121+
| `.internal.cases-activity.<space-name>-cases` | `.cases-activity.<space-name>-cases` | Stack Management cases |
122+
| `.internal.cases-activity.<space-name>-observability` | `.cases-activity.<space-name>-observability` | {{observability}} cases |
123+
| `.internal.cases-activity.<space-name>-securitysolution` | `.cases-activity.<space-name>-securitysolution` | Security cases |

‎explore-analyze/toc.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,5 +365,5 @@ toc:
365365
- file: alerts-cases/cases/setup-cases.md
366366
- file: alerts-cases/cases/manage-cases.md
367367
- file: alerts-cases/cases/manage-cases-settings.md
368-
- file: alerts-cases/cases/visualize-case-data.md
368+
- file: alerts-cases/cases/cases-as-data.md
369369
- file: numeral-formatting.md

‎solutions/observability/incident-management/cases.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@ Collect and share information about observability issues by creating a case. Cas
1717
:screenshot:
1818
:::
1919

20-
::::{note}
21-
{applies_to}`stack: ga 9.2` With the appropriate index access, you can [build visualizations and metrics](../../../explore-analyze/alerts-cases/cases/visualize-case-data.md) of data in {{observability}}, {{stack-manage-app}}, and {{elastic-sec}} cases. This can provide improved visibility into patterns and trends of cases within your space.
20+
::::{tip}
21+
:applies_to: stack: preview 9.2
22+
After creating cases, use case data to build dashboards and visualizations that give you insights into case trends and operational metrics. Refer to [Use cases as data](/explore-analyze/alerts-cases/cases/cases-as-data.md) to learn more.
2223
::::
2324

2425
## Limitations [observability-case-limitations]

‎solutions/security/investigate/cases.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,12 @@ You can also send cases to these external systems by [configuring external conne
3030
:screenshot:
3131
:::
3232

33-
::::{note}
34-
{applies_to}`stack: ga 9.2` With the appropriate index access, you can [build visualizations and metrics](../../../explore-analyze/alerts-cases/cases/visualize-case-data.md) of data in {{observability}}, {{stack-manage-app}}, and {{elastic-sec}} cases. This can provide improved visibility into patterns and trends of cases within your space.
33+
::::{tip}
34+
:applies_to: stack: preview 9.2
35+
After creating cases, use case data to build dashboards and visualizations that give you insights into case trends and operational metrics. Refer to [Cases as data](/explore-analyze/alerts-cases/cases/cases-as-data.md) to learn more.
3536
::::
3637

38+
3739
## Limitations [security-case-limitations]
3840

3941
* If you create cases in the {{security-app}}, they are not visible from {{observability}} or {{stack-manage-app}}. Likewise, the cases you create in {{stack-manage-app}} are not visible in {{elastic-sec}} or {{observability}}.

0 commit comments

Comments
 (0)