Hi team,
I’m developing a custom view using the native dashboarding features in Google SecOps. I’ve noticed a variance in the playbook counts and I’m trying to understand the cause of this mismatch.
I’ve attached two screenshots:
- Snip 1: Counts playbooks by playbook name and the distinct count of metadata_alert_id.
- Snip 2: Counts playbooks by playbook name only.
Could you help explain why these two approaches return different totals?
============================================================
Snip1
============================================================
Snip2
