Create analysts_incidents

scottbrumley · Oct 2, 2024 · 2f1c1ee · 2f1c1ee
1 parent dcb73d5
commit 2f1c1ee
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/SOC_Framework/Widgets/analysts_incidents b/SOC_Framework/Widgets/analysts_incidents
@@ -0,0 +1,14 @@
+dataset = alerts 
+| arrayexpand original_tags
+| filter original_tags contains "DS:"
+// Open manual alerts
+| filter resolution_status = ENUM.NEW or resolution_status = ENUM.UNDER_INVESTIGATION 
+| comp count_distinct(incident_id) as total_incidents by original_tags    
+| sort desc total_incidents 
+
+
+
+
+
+
+| view graph type = pie header = "Total Manual Incidents" xaxis = original_tags yaxis = total_incidents