How to Map Detection Rules to Related Cases in Dashboard

Thanks ​@cmorris for a quick fix. It worked. 

Initially, I was only looking at the detection.collection_elements.references.event UDM field.

A couple of follow-up questions:

* Can we use strings.coalesce() here?
* Is it possible to construct a redirection link to the detection by concatenating the default detection URL with the rule ID (detection.detection.rule_id) using strings.concat()? That way, clicking the link would take us directly to the detection page and also, can we build a link using the case.response_platform_info.response_platform_id that redirects directly to the corresponding case page?

strings.coalesce() should work in the dashboard query.

Unfortunately we cannot join the detection dataset with the case dataset today. I do have an open feature request (# 540805241) to do that. We can pull the rule_id from the case dataset however.

By default, case.response_platform_info.response_platform_id should be clickable. We can build the URL to the rule using the ID, but that link will not be clickable.

Please try this updated query (replace the URL frontend on the strings.concat line first):

case.status = "CLOSED"
case.display_name = $case_name
case.response_platform_info.response_platform_id = $case_id
case.alerts.metadata.collection_elements.references.event.principal.hostname = $princ_host
case.alerts.metadata.collection_elements.references.event.principal.user.userid = $princ_user
case.closure_details.reason = $reason
case.closure_details.root_cause = $root_cause
case.alerts.metadata.detection.rule_name = $rule_name
case.alerts.metadata.detection.rule_id = $rule_id
strings.concat("https://REPLACE.backstory.chronicle.security/rules/", case.alerts.metadata.detection.rule_id) = $rule_link


match:
    $case_id, $case_name, $reason, $root_cause, $rule_link

outcome:
    $r_name = array_distinct($rule_name)
    $p_host = array_distinct($princ_host)
    $p_user = array_distinct($princ_user)

Result:

Note in the screenshot that I have multiple lines returning for a single case. This is due to the alerts grouping feature I have configured that has multiple alerts within the one case here, each with a different $rule_link value, which I have in the match section. You could move the link to outcome to get the cases back on a single line, but I think readability with the query above is easier. YMMV, depending on your alerts grouping config.