Hi,

I'm pretty new to SecOps Siem and I'd like to create a Dashboard correlating the following fields together:

• Alerts,
• Cases,
• Severity/Priority,
• User/Analyst
• Alert Creation Time
• Alert Assign Time
• Alert Closing Time

Using booth SIEM Dashboards and SOAR Reports, I was able in SOAR Reports under Advanced Reports to achive some sort of results.

Creating a dashboard (SOAR Reports > Advanced Reports >Managed Detection Response ) with the following fields:

• Identifier, Alert Creation Date Time Date, Case ID, Case Priority, 

I get a certain amount of IDENTIFIERS which are related to the amount of ALERTs in a given period.

Instead using Managed Detection Response I tried to use Alert And Entities  with the following fields:

• Alert Identifier, Analyst, Case Close Reason,,Case ID,Case Priority, Time • Creation Time Date, Root Cause, Status, Title

Then I tried something simpler:

• Managed Detection Response:  just field Alert Identifier with the function count distinct
• Alert And Entities: just field Alert Identifier with the function count distinct

The time frame field is:

• Alert and Entities: Creation Time Time

• Managed Detection Response: Alert Creation Date Time Time

Comparing the total amount in booth dashboard I found 2 different amounts for the same given period.

Do you have any idea why?

As said at the beginning the goal is to create a dashboard with the fields:

• Alerts,
• Cases,
• Severity/Priority,
• User/Analyst
• Alert Creation Time
• Alert Assign Time
• Alert Closing Time

Thanks.