SLA dashboard for Chronicle Secops

Hi Duttyatharth

Modelled on
https://docs.cloud.google.com/chronicle/docs/reference/soar-data-dashboard#soar-case-activity-enum

 

$case_ID = case_history.case_response_platform_info.case_id
$activity_type = case_history.case_activity
$activity_type = "EXCEEDED_SLA"
$stage = case_history.stage
$time = timestamp.get_timestamp(case_history.event_time.seconds)

match:
   $case_ID, $activity_type, $stage, $time

This gives every time a Case exceeded_sla, this includes system stages, but you can remove these if needed
 

Turning this into a bar chart

 

$case_id = case_history.case_response_platform_info.case_id
$activity_type = case_history.case_activity
$activity_type = "EXCEEDED_SLA"
$stage = case_history.stage
$time = timestamp.get_timestamp(case_history.event_time.seconds)

match:
   $activity_type, $stage, $time
outcome:
   $count = count($case_id)

HTH?​​​​​​​

Andy

i've been trying multiple methods to join the case and case_history sections in chronicle dashboards to get the values specfically for  cases the SOC is working on like filtering out  (case.environment = "Default" and case.assignee.soc_roles = "SOC" ). but it hasnt been working out as expected.