Skip to main content
Question

Google SecOps Dashboard with SOAR Alerts added to Cases

  • October 30, 2025
  • 1 reply
  • 36 views

ar3diu
Forum|alt.badge.img+8

Any tips for building a dashboard with a table that counts the alerts ingested in SOAR?

I’m not sure where the alert name could be found...

```

case.status = "CLOSED" AND NOT (case.type = "TEST" OR case.tags.name = "Simulated Case")
$Alert = case.alerts.metadata.soar_alert_metadata.source_rule
match: 
    $Alert

outcome:

    $Count = count(case.alerts.metadata.id)

order: 
    $Count desc 
limit: 
    10

```

1 reply

ar3diu
Forum|alt.badge.img+8
  • Author
  • Silver 2
  • October 30, 2025

It seems that the following works only for SIEM alerts:

$Alert = case.alerts.metadata.detection.rule_name