How to build SLA dashboards for cases and analysts in Google SecOps?

Most of the data you would need can be found in SOAR data in Dashboards in the Case History Section.

And you can take a look at ​@jstoner ‘s great blogs on building dashboards to get ideas on how to put together what you need.

How can we include the environment filter with case_history as I needed to calculate the SLA based on SOAR environment for that case.

Joins on case and case_history should be rolling out by the end of the month. At that point, you could try a join with your environment specified like this:

$h.case_history.case_response_platform_info.case_id = $case_id
$c.case.response_platform_info.response_platform_id = $case_id
$c.case.environment = "Default Environment"

$h.case_history.case_response_platform_info.case_id = $case_id
$c.case.response_platform_info.response_platform_id = $case_id
$c.case.environment = "Default Environment"

I needed to calculate the same SLA but for specific environment only , but if i add case.environment it's not getting supported.

stage stage1{
$case_id = case_history.case_response_platform_info.case_id
match:
$case_id
outcome:
$case_assign_time = min(if(case_history.case_activity = "ASSIGNEE_CHANGE", case_history.event_time.seconds, [removed by moderator] ))
$status = array_distinct(case_history.case_activity)
$TTA = $case_assign_time - min(case_history.event_time.seconds)

condition:
arrays.contains($status, "CREATE_CASE") and arrays.contains($status, "ASSIGNEE_CHANGE")
}
outcome:
$case_count = count($stage1.case_id)
$MTTA = avg($stage1.TTA)/60

Yes, unfortunately you cannot join the case and case_history datasets today, which is why you get that error when you try to add case.environment to your existing query that uses case_history. Support for that join should be coming out the end of this month and then you will be able to.

Ok, thanks ​@cmorris