Hi,

If I were you, I'd start building that user-based dashboard in Google SecOps by prioritizing the ingestion of your Identity Provider (IdP) logs (like Entra ID, Okta, Google Workspace, etc.). These are absolutely crucial, as they contain the most accurate and immediate user login details.

Fortunately, Google SecOps gives you a fantastic head start. There's already a "User Sign-In Overview" dashboard that provides much of the functionality you're looking for. Here’s what I’d recommend:

1. Duplicate the existing "User Sign-In Overview" dashboard. This allows you to customize it without affecting the original.

2. Add a Dashboard Filter to the duplicated version. Configure the filter to use a common user identifier like principal.user.userid, target.user.userid, or principal.user.email_addresses.
   This step is key—it will let you select a specific user and have the entire dashboard dynamically update with their information.

I think if you start from this, you'll be on the right track!

Thanks for your insights. 
I have a followup question, where when i filter the userid in the native dashboard, i would like to get the previous cases that the user was associated with. is there any way to get the list of case ids in which the user was involved?