Comparison of Alert Creation time vs Case Creation Time in SecOps Dashboard

something like this should work…

// 1. Filter for valid cases

case.name != ""

match:

case.name // Group by the GUID to isolate each case

outcome:

// SOAR Case Creation Time

$soar_created_at = max(case.create_time.seconds)

// SIEM Alert (Detection) Time

$siem_alert_at = max(case.alerts.metadata.detection_time.seconds)

// Calculate latency in minutes

$latency_minutes = ($soar_created_at - $siem_alert_at) / 60

// UI Metadata

$case_display_name = array_distinct(case.display_name)

$rule_names = array_distinct(case.alerts.metadata.detection.rule_name)

order:

$latency_minutes desc

Thank you for getting back to this. 

But below variables are not populating any details.

SIEM Alert (Detection) Time

$siem_alert_at = max(case.alerts.metadata.detection_time.seconds)

$rule_names = array_distinct(case.alerts.metadata.detection.rule_name)

the query shared by ​@dnehoda works, however there might be SOAR cases created from other sources rather than SIEM alerts.

to always get the SIEM Alert detection time populated, you can narrow down the query base dataset to those SOAR cases created by the SIEM alerts only. For instance in the query shared by Dave, add this additional filter before the match section:

case.alerts.metadata.id != ""

resulting in:

//SIEM alert to SOAR case creation: latency, by SOAR case:

case.name != ""
case.alerts.metadata.id != ""
match: case.name // Group by the GUID to isolate each case
outcome:
$case_display_name = array_distinct(case.display_name)
$rule_name = array_distinct(case.alerts.metadata.detection.rule_name)
$soar_created_at = max(case.create_time.seconds)
$siem_alert_at = max(case.alerts.metadata.detection_time.seconds)
$latency_minutes = math.round(($soar_created_at - $siem_alert_at)/60,2)
order:$latency_minutes desc

other examples:

//SIEM alert to SOAR case creation: average latency and case count, by SIEM rule:

case.name != ""
case.alerts.metadata.id != ""
$case_create_time = case.create_time.seconds
$alert_time = case.alerts.metadata.detection_time.seconds
$rule_name = case.alerts.metadata.detection.rule_name
match: $rule_name 
outcome:
$case_count=count_distinct(case.name)
$avg_latency_minute = math.round(window.avg($case_create_time - $alert_time)/60, 2)
order: $case_count desc

Curated Dashboard query examples using SOAR data schema

More examples

SOAR cases and alerts data schema documentation

(The links might stop working in the future as Google is reorganizing the docs)
 

Amazing ! Thanks