Hi @pdgill314 You could start with the `notable` search and then to a lookup on Rule_ID/event_id, however there might be an easier way. I believe the KV Store incident_review_lookup has an urgency ...
See more...
Hi @pdgill314 You could start with the `notable` search and then to a lookup on Rule_ID/event_id, however there might be an easier way. I believe the KV Store incident_review_lookup has an urgency field... Try: | inputlookup incident_review_workflow_audit
| lookup incident_review_lookup rule_id OUTPUT urgency
| where urgency="critical"
``` then the rest as before ```
| where notable_time > relative_time(now(), "-1mon@mon")
AND notable_time < relative_time(now(), "@mon")
| eval
EventOpenedEpoch = notable_time,
TriageStartedEpoch = triage_time,
ResolutionEpoch = notable_time + new_to_resolution_duration,
DaysInNewStatus = round(new_duration/86400,2),
DaysToResolution = round(new_to_resolution_duration/86400,2)
| where new_to_resolution_duration>0
| eval
"Event Opened" = strftime(EventOpenedEpoch, "%Y-%m-%d %H:%M:%S"),
"Triage process started" = strftime(TriageStartedEpoch, "%Y-%m-%d %H:%M:%S"),
"Event Resolved" = strftime(ResolutionEpoch, "%Y-%m-%d %H:%M:%S")
| rename rule_id AS "Event ID"
| table
"Event ID",
"Event Opened",
"Triage process started",
"Event Resolved",
DaysInNewStatus,
DaysToResolution
urgency
| sort - DaysToResolution Im not infront of an ES deployment at the minute so sorry I cant test completely! Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing