Skip to content

Commit 97995ba

Browse files
nastasha-solomonmdbirnstiehl
nastasha-solomon
and
mdbirnstiehl
authored
[DOCS][Cases][9.2] Case analytics indices schema (#229036)
Contributes to elastic/docs-content#1716 by documenting the schema for case analytics indices. [Preview](https://docs-v3-preview.elastic.dev/elastic/kibana/pull/229036/reference/case-analytics-indices-schema) **Related PR:** elastic/docs-content#2220 --------- Co-authored-by: Mike Birnstiehl <[email protected]>
1 parent 4c01782 commit 97995ba

File tree

2 files changed

+126
-0
lines changed

2 files changed

+126
-0
lines changed

‎docs/reference/case-analytics-indices-schema.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
applies_to:
3+
stack: preview 9.2
4+
serverless: unavailable
5+
---
6+
7+
# Case analytics indices schema[case-analytics-indices-schema]
8+
9+
This page lists fields that can appear in case analytics indices documents. These fields display general data about cases, in addition to data about case comments, attachments, and activity.
10+
11+
% To learn more about the indices and cases as data feature, refer to [Use cases as data](docs-content://explore-analyze/alerts-cases/cases/cases-as-data.md).
12+
13+
::::{important}
14+
The cases as data feature is in technical preview, meaning the schema for the case analytics indices is subject to change.
15+
::::
16+
17+
## General case data
18+
19+
| Name | Field type | Description |
20+
| :---- | :---- | :---- |
21+
| @timestamp | date | The date the document for the case was added to the case analytics indices.
22+
| title | text / semantic\_text | The case title. |
23+
| description | text / semantic\_text | The case description. |
24+
| tags | keyword | Tags added to case. |
25+
| category | keyword | The case category. |
26+
| status | keyword | The case status. Possible values are `open`, `in-progress`, `closed`. |
27+
| status\_sort | long | The status of the case. Possible values are `0`, `10`, `20`, where `0` corresponds to the `open` status, `10` corresponds to the `in-progress` status, and `20` corresponds to the `closed` status.|
28+
| severity | keyword | The case severity. Possible values are `low`, `medium`, `high`, `critical`. |
29+
| severity\_sort | long | The severity of the case. Possible values are `0`, `10`, `20`, `30`, where `0` corresponds to the `low` severity, `10` corresponds to the `medium` severity, `20` corresponds to the `high` severity, and `30` corresponds to the `critical` severity.|
30+
| created\_at | date | The date of when the case was created, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
31+
| created\_at\_ms | long | The case creation timestamp in milliseconds. |
32+
| created\_by.username | keyword | The username of the user who created the case. |
33+
| created\_by.profile\_uid | keyword | The user ID of the user who created the case. |
34+
| created\_by.full\_name | keyword | The full name of the user who created the case. |
35+
| created\_by.email | keyword | The email address of the user who created the case. |
36+
| updated\_at | date | The date of when case was last modified, provided in ISO 8601 \[2\] and set to the servers' timezone. |
37+
| updated\_at\_ms | long | The case update timestamp in milliseconds. |
38+
| updated\_by.username | keyword | The username of the user who last updated the case. |
39+
| updated\_by.profile\_uid | keyword | The user ID of the user who last updated the case. |
40+
| updated\_by.full\_name | keyword | The full name of the user who last updated the case. |
41+
| updated\_by.email | keyword | The email address of the user who last updated the case. |
42+
| closed\_at | date | The date of case closure, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
43+
| closed\_at\_ms | long | The case closure timestamp in milliseconds. |
44+
| closed\_by.username | keyword | The username of the user who closed the case. |
45+
| closed\_by.profile\_uid | keyword | The user ID of the user who closed the case. |
46+
| closed\_by.full\_name | keyword | The full name of the user who closed the case. |
47+
| closed\_by.email | keyword | The email address of the user who closed the case. |
48+
| assignees | keyword | The user IDs of the users assigned to the case. |
49+
| time\_to\_resolve | long | The time in seconds taken to mark the case as **Closed**. It is calculated by measuring how long it took to update the case status from **Open** to **Closed**. |
50+
| time\_to\_acknowledge | long | The time in seconds taken to mark the case as in progress. It is calculated by measuring how long it took to update the case status to **In progress** after the case was created. |
51+
| time\_to\_investigate | long | The time in seconds taken to mark the case as **Closed**. It is calculated by measuring how long it took to update the case status from **In progress** to **Closed**. |
52+
| custom\_fields.type | keyword | The custom field type. |
53+
| custom\_fields.label | keyword | The custom field label. |
54+
| custom\_fields.value | keyword | The value of the custom field value. |
55+
| observables.type | keyword | The observable type. |
56+
| observables.label | keyword | The observable label. |
57+
| observables.value | keyword | The observable value. |
58+
| total\_comments | integer | The total number of comments in a case. |
59+
| total\_alerts | integer | The total number of alerts attached to a case. |
60+
| total\_assignees | integer | The total number of assignees to a case. |
61+
| owner | keyword | The case owner. |
62+
| space\_ids | keyword | A list of spaces where the case is visible. |
63+
64+
## Case comments
65+
66+
| Name | Field type | Description |
67+
| :---- | :---- | :---- |
68+
| @timestamp | date | The date the document for the case was added to the case analytics indices. |
69+
| case\_id | keyword | The case UUID. |
70+
| comment | text | The user’s comment. |
71+
| created\_at | date | The date the comment was added, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
72+
| created\_by.username | keyword | The username of the user who created the case. |
73+
| created\_by.profile\_uid | keyword | The user ID of the user who created the case. |
74+
| created\_by.full\_name | keyword | The full name of the user who created the case. |
75+
| created\_by.email | keyword | The email address of the user who created the case. |
76+
| updated\_at | date | The date of the last case update, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
77+
| updated\_by.username | keyword | The username of the user who last updated the case. |
78+
| updated\_by.profile\_uid | keyword | The user ID of the user who last updated the case. |
79+
| updated\_by.full\_name | keyword | The full name of the user who last updated the case. |
80+
| updated\_by.email | keyword | The email address of the user who last updated the case. |
81+
| owner | keyword | The case owner. |
82+
| space\_ids | keyword | The list of spaces the case is visible. |
83+
84+
## Case attachments
85+
86+
| Name | Field type | Description |
87+
| :---- | :---- | :---- |
88+
| @timestamp | date | The date the document for the case was added to the case analytics indices. |
89+
| case\_id | keyword | The case UUID. |
90+
| type | keyword | The type of attachment. |
91+
| payload | flattened | The data in the attachment. |
92+
| payload.alerts.id | keyword | The ID of the alert. |
93+
| payload.alerts.index | keyword | The index that stores the alert document. |
94+
| payload.file.id | keyword | The file ID. |
95+
| payload.file.extension | keyword | The file extension. |
96+
| payload.file.mimeType | keyword | The file mime type. |
97+
| payload.file.name | keyword | The file name. |
98+
| created\_at | date | The date of when the case was created, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
99+
| created\_by.username | keyword | The username of the user who created the case. |
100+
| created\_by.profile\_uid | keyword | The user ID of the user who created the case. |
101+
| created\_by.full\_name | keyword | The full name of the user who created the case. |
102+
| created\_by.email | keyword | The email address of the user who created the case. |
103+
| owner | keyword | The case owner. |
104+
| space\_ids | keyword | The list of spaces the case is visible. |
105+
106+
## Case activity
107+
108+
| Name | Field type | Description |
109+
| :---- | :---- | :---- |
110+
| @timestamp | date | The date the document for the case was added to the case analytics indices. |
111+
| case\_id | keyword | The case UUID. |
112+
| action | keyword | The user’s action. Possible values are `add`, `create`, `update`, `delete`. |
113+
| type | keyword | The type of the action a user took. Possible values are `status`, `create_case`, `delete_case`. |
114+
| payload.status | keyword | The new case status. Possible values are `open`, `in-progress`, `closed`. |
115+
| payload.tags | keyword | The new case tags. |
116+
| payload.category | keyword | The new case category. |
117+
| payload.severity | keyword | The new case severity. Possible values are `low`, `medium`, `high`, `critical`. |
118+
| created\_at | date | The date of when the case was created, provided in ISO 8601 \[2\] format and set to the servers' timezone. |
119+
| created\_at\_ms | long | The case creation timestamp in milliseconds. |
120+
| created\_by.username | keyword | The username of the user who created the case. |
121+
| created\_by.profile\_uid | keyword | The user ID of the user who created the case. |
122+
| created\_by.full\_name | keyword | The full name of the user who created the case. |
123+
| created\_by.email | keyword | The email address of the user who created the case. |
124+
| owner | keyword | The case owner. |
125+
| space\_ids | keyword | The list of spaces the case is visible. |

‎docs/reference/toc.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,4 @@ toc:
7272
- file: commands/kibana-verification-code.md
7373
- file: osquery-exported-fields.md
7474
- file: osquery-manager-prebuilt-packs.md
75+
- file: case-analytics-indices-schema.md

0 commit comments

Comments
 (0)