Playbook Count variance in Native Dashboarding

1. The Relationship Hierarchy

In Google SecOps, a single Alert ID can be associated with multiple playbook executions. This happens for several reasons:

• Retries and Re-runs: If a playbook fails or is manually restarted by an analyst, the same metadata_alert_id remains constant, but a new playbook execution instance is recorded.

• Multiple Playbooks per Alert: You might have automation rules that trigger a "Triage" playbook AND a "Remediation" playbook for the same alert ID.

2. Comparing the Two Snips

Snip 1: count_distinct(metadata_alert_id)

This approach is counting unique security events.

• What it says: "How many individual alerts triggered at least one playbook?"

• The Result: If "Playbook A" ran five times on the exact same Alert ID, this count will only show 1. It filters out the noise of repetitions.

Snip 2: count(playbook_name)

This approach is counting execution instances.

• What it says: "How many times did this playbook start, regardless of what triggered it?"

• The Result: If "Playbook A" ran five times on the same Alert ID, this count will show 5.