In Google SecOps SOAR, the closure verdict (reason, root cause, comment, closing time) is stored per alert. A case can contain many alerts closed with different root causes at different times. In the Native Dashboards data model, however, closure information appears to be exposed only at case level (case.closure_details.*). We cannot find any field path that returns the per-alert closure verdict.
As a result, alert-level closure reporting (e.g. "alert true-positive rate", "root cause distribution per alert") cannot be built in Native Dashboards, and naive queries silently produce wrong numbers.
What we are trying to build:
A dashboard panel that answers: "For closed alerts, how many were closed with which closure reason / root cause, over time?" at alert granularity, not case granularity.
Is the per-alert closure verdict (reason, root cause, comment, closing time as stored in alertCards[].closureDetails) exposed in any Native Dashboards data source? If yes, what is the exact field path?
The case.closure_details.* returns a single value per case,. Which alert's closure does this value come from? The most recently closed alert?
