Optimize dashboard window summary queries

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/apps/alerts/migrations/0003_alert_alert_event_time_expr_idx.py

@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-11 00:56
+
+import django.db.models.functions.comparison
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('alerts', '0002_alert_alert_created_id_idx_and_more'),
+        ('artifacts', '0002_artifact_artifact_created_id_idx'),
+        ('cases', '0002_case_case_created_id_idx'),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name='alert',
+            index=models.Index(django.db.models.functions.comparison.Coalesce('last_seen_time', 'first_seen_time', 'created_at', output_field=models.DateTimeField()), name='alert_event_time_expr_idx'),
+        ),
+    ]

backend/apps/alerts/models.py

@@ -1,4 +1,5 @@
 from django.db import models
+from django.db.models.functions import Coalesce
 
 from apps.common.models import BaseModel
 from apps.common.readable_ids import save_with_readable_id
@@ -225,6 +226,10 @@ class Alert(BaseModel):
         indexes = [
             models.Index(fields=["-created_at", "-id"], name="alert_created_id_idx"),
             models.Index(fields=["-first_seen_time", "-id"], name="alert_first_seen_id_idx"),
+            models.Index(
+                Coalesce("last_seen_time", "first_seen_time", "created_at", output_field=models.DateTimeField()),
+                name="alert_event_time_expr_idx",
+            ),
         ]
 
     def __str__(self):

backend/apps/dashboard/views.py

@@ -11,7 +11,6 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from apps.alerts.models import Alert, AlertStatus, AlertTactic
-from apps.artifacts.models import Artifact
 from apps.cases.models import Case, CaseStatus
 from apps.enrichments.models import Enrichment
 from apps.knowledge.models import Knowledge, KnowledgeSource
@@ -92,6 +91,39 @@ def alert_event_queryset(start):
     ).filter(event_time__gte=start)
 
 
+def alert_window_summary_counts(start):
+    with connection.cursor() as cursor:
+        cursor.execute(
+            """
+            SELECT
+                COUNT(*)::int,
+                COUNT(*) FILTER (WHERE severity = ANY(%s))::int
+            FROM alerts
+            WHERE COALESCE(last_seen_time, first_seen_time, created_at) >= %s
+            """,
+            [list(IMPORTANT_LEVELS), start],
+        )
+        total_alerts, critical_high_alerts = cursor.fetchone()
+    return {
+        "total_alerts": total_alerts,
+        "critical_high_alerts": critical_high_alerts,
+    }
+
+
+def count_window_artifacts(start):
+    with connection.cursor() as cursor:
+        cursor.execute(
+            """
+            SELECT COUNT(DISTINCT alerts_artifacts.artifact_id)::int
+            FROM alerts_artifacts
+            JOIN alerts ON alerts.id = alerts_artifacts.alert_id
+            WHERE COALESCE(alerts.last_seen_time, alerts.first_seen_time, alerts.created_at) >= %s
+            """,
+            [start],
+        )
+        return cursor.fetchone()[0]
+
+
 def case_workload_queryset(start):
     return Case.objects.filter(
         Q(status__in=OPEN_CASE_STATUSES)
@@ -461,19 +493,21 @@ def build_dashboard_overview(window):
     completed_playbooks = successful_playbooks + failed_playbooks
 
     total_cases = window_cases.count()
+    alert_summary_counts = alert_window_summary_counts(start)
+    total_artifacts = count_window_artifacts(start)
     cases_with_enrichments = window_cases.filter(enrichments__isnull=False).distinct().count()
     cases_with_playbooks = window_cases.filter(playbooks__isnull=False).distinct().count()
 
     summary = {
         "active_risk_index": build_active_risk_index(open_cases, window_alerts, window_playbooks),
         "total_cases": total_cases,
-        "total_alerts": window_alerts.count(),
-        "total_artifacts": Artifact.objects.filter(alerts__in=window_alerts).distinct().count(),
+        "total_alerts": alert_summary_counts["total_alerts"],
+        "total_artifacts": total_artifacts,
         "total_enrichments": Enrichment.objects.filter(created_at__gte=start).count(),
         "total_knowledge": Knowledge.objects.filter(created_at__gte=start).count(),
         "open_cases": open_cases.count(),
         "open_critical_cases": open_cases.filter(severity="Critical").count(),
-        "critical_high_alerts": window_alerts.filter(severity__in=IMPORTANT_LEVELS).count(),
+        "critical_high_alerts": alert_summary_counts["critical_high_alerts"],
         "running_playbooks": playbook_status_counts.get(PlaybookJobStatus.RUNNING, 0),
         "failed_playbooks": failed_playbooks,
         "automation_success_rate": percentage(successful_playbooks, completed_playbooks),
@@ -483,7 +517,7 @@ def build_dashboard_overview(window):
         "enrichment_coverage": percentage(cases_with_enrichments, total_cases),
         "playbook_coverage": percentage(cases_with_playbooks, total_cases),
         "knowledge_records": Knowledge.objects.filter(created_at__gte=start, source=KnowledgeSource.CASE).count(),
-        "artifact_records": summary["total_artifacts"],
+        "artifact_records": total_artifacts,
         "enrichment_records": summary["total_enrichments"],
     }