<form version="1.1">
  <label>Threat Dashboard</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="time" searchWhenChanged="true" token="time_token">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="devname">
      <label>Device</label>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.utm, log.devname)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <prefix>log.devname="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="dropdown" token="vdom" searchWhenChanged="true">
      <label>Virtual Domain</label>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.utm, log.vd)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <prefix>log.vd="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="dropdown" token="subtype">
      <label>Subtype</label>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.utm, log.subtype)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <default>*</default>
      <prefix>log.subtype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="text" token="srcip">
      <label>Source IP</label>
      <prefix>log.srcip="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="text" token="dstip">
      <label>Destination IP</label>
      <prefix>log.dstip="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="text" token="dstport">
      <label>Destination Port</label>
      <prefix>log.dstport="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Threat By Severity</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel=ftnt_fos where nodename="log.utm" log.utm.gseverity!="" $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$   GROUPBY _time  log.utm.gseverity | timechart values(count) by log.utm.gseverity</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_utm` severity="$click.name2$" earliest=$click.value$ [| stats count | eval latest = $click.value$ %2b 300 | fields latest]
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>IPS Attack By Device</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count  FROM datamodel="ftnt_fos" WHERE nodename="log.utm.ips" $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$  GROUPBY log.devname  | sort -count | head 30</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisY2.enabled">undefined</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_ips` devname="$click.value$"&earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Threat By SubType</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.utm" log.utm.gseverity!=""  $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$   GROUPBY log.subtype | sort -count  | head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisY2.enabled">undefined</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search (log.utm.gseverity!="" AND log.subtype="$click.value$")&earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Threat By Source IP</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.utm" log.utm.gseverity!=""  $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$   GROUPBY log.srcip | sort -count | head 30</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisY2.enabled">undefined</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search (log.utm.gseverity!="" AND log.srcip="$click.value$")&earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Threat By Destination IP</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.utm" $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$ log.utm.gseverity!="" GROUPBY log.dstip| sort-count | head 30</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisY2.enabled">undefined</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search (log.utm.gseverity!="" AND log.dstip="$click.value$")&earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Threat By User</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.utm" log.utm.gseverity!=""  log.user!="" $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$   GROUPBY log.user | sort -count | head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search (log.utm.gseverity!="" AND log.user="$click.value$")&earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Threat By Service</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.utm" log.utm.gseverity!=""  $devname$ $vdom$ $subtype$ $srcip$ $dstip$ $dstport$   GROUPBY log.utm.service | sort -count | head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search (log.utm.gseverity!="" AND log.utm.service="$click.value$")&earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
