cmd.sql

SELECT id, event_caseId, step, cond, timestamp, status
    FROM
    (SELECT *, IF(@id=@id:=result.event_caseId,@count:=@count+1,@count:=0) as pos
        FROM        
        (SELECT e.id, e.event_caseId, e.step, e.cond, e.timestamp, e.status
            FROM falcon_portal.events AS e 
            INNER JOIN
                (SELECT a.id, a.endpoint, a.metric, a.note, a.priority, a.status, a.timestamp,
                       a.update_at, a.template_id, a.tpl_creator, a.process_status 
                    FROM falcon_portal.event_cases AS a 
                    WHERE a.status = 'PROBLEM' 
                    ORDER BY a.update_at DESC 
                    LIMIT 10) AS limited_alert 
            ON e.event_caseId = limited_alert.id) AS result
        JOIN (SELECT @id:=0, @count:=0) AS c) AS final_result
WHERE final_result.pos < 10;