Track Changes to a field

[akselsoeb]

Hello guys

I need some help with making a table/dashboard that shows me changes to incidents in our Defender platform.
The underlying issue that we see is that Defender sometimes, when an incident is handled by automation, de-escalate the severity of a particular incident.

So in my index of incidents i want to track for each specific incident that is handled by automation to show me when the severity field changes. 

The table should look something link this.

IncidentId       Description       Status    Old_Severity     New_Severity


I don't know whether to use the streamstats or the dedup command. I've been fiddling abit with both but can't seem to get the right output.

Anyways, hope you can help me out here. If theres something unclear about my question, let me know so i can clarify.

[dtburrows3 · Accepted solution]

So if you just want to narrow down on the IncidentIds that this occurred on, I thing doing a stats aggregation would be more efficient. Something like this.

<base_search>
    | fields + _time, IncidentId, Description, Status, Severity
    | sort 0 +_time
    | stats
        values(Description) as Description,
        latest(Status) as Status,
        dc(Severity) as dc_severity,
        list(Severity) as Sequence_Severity,
        earliest(Severity) as Old_Severity,
        latest(Severity) as New_Severity
            by IncidentId
    | where 'dc_severity'>1
    | fields - dc_severity

 
If you want to retain all of the original events apart of any IncidentId that this occurred on then you could use some sort of combo of streamstats and eventstats (less efficient but more detailed)

<base_search>
    | fields + _time, IncidentId, Description, Status, Severity
    | sort 0 +IncidentId, -_time
    | streamstats window=2
        earliest(Severity) as Old_Severity,
        latest(Severity) as New_Severity
            by IncidentId
    | eventstats
        max(eval(if(NOT 'Old_Severity'=='New_Severity', 1, 0))) as status_change
            by IncidentId
    | where 'status_change'>0
    | fields - status_change

[akselsoeb]

Thank you @dtburrows3 
This was exactly what i was looking for.