Comparison of Alert Creation time vs Case Creation Time in SecOps Dashboard

something like this should work…

// 1. Filter for valid cases

case.name != ""

match:

case.name // Group by the GUID to isolate each case

outcome:

// SOAR Case Creation Time

$soar_created_at = max(case.create_time.seconds)

// SIEM Alert (Detection) Time

$siem_alert_at = max(case.alerts.metadata.detection_time.seconds)

// Calculate latency in minutes

$latency_minutes = ($soar_created_at - $siem_alert_at) / 60

// UI Metadata

$case_display_name = array_distinct(case.display_name)

$rule_names = array_distinct(case.alerts.metadata.detection.rule_name)

order:

$latency_minutes desc

Thank you for getting back to this. 

But below variables are not populating any details.

SIEM Alert (Detection) Time

$siem_alert_at = max(case.alerts.metadata.detection_time.seconds)

$rule_names = array_distinct(case.alerts.metadata.detection.rule_name)