<form version="1.1">
  <label>AD Objects - Group Policy - Changes</label>
  <search id="base_gpo_chg_search">
    <query>`ms_obj_changes_base_cat("Group Policy")` (src_nt_domain="$tok_domain$" OR dest_nt_domain="$tok_domain$")
| fields _time, session_id, src_nt_domain, src_user,Object_Name_Guid,displayName,dir_svcs_action,AttributeLDAPDisplayName,AttributeValue,MSADChangedAttributes,Correlation_ID,signature,msad_action,Old_DN,New_DN
| fillnull value="NA" Correlation_ID,msad_action
| eval adminuser=if(isnull(src_nt_domain),src_user,src_nt_domain."\\".src_user) 
| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" 
| `ms_obj_msad-changed-attributes`
| stats max(_time) AS last_time, min(_time) AS start_time,list(MSADChanges) AS MSADChanges,values(Correlation_ID) AS Correlation_IDs by session_id,Object_Lookup_Name,adminuser,signature,msad_action,src_user
| eval signature=mvdedup(signature)
| join type=left Object_Lookup_Name [| inputlookup AD_Obj_GPO | fields cn, displayName | eval Object_Lookup_Name=trim(lower(cn)) | table Object_Lookup_Name, displayName]
| eval displayName=if(isnull(displayName),"NotFound: ".Object_Lookup_Name,displayName) 
| eval MSADChanges=mvjoin(MSADChanges, "########")
| eval MSADChanges=case(isnull(signature) AND isnull(MSADChanges),"Unknown Changes",isnull(signature),MSADChanges,isnotnull(MSADChanges),"Signature: ".signature."########".MSADChanges)
| eval Session_Time="Session ID (".session_id.")|Start: ".strftime(start_time,"%m/%d/%y %I:%M:%S %P")."|End: ".strftime(last_time,"%m/%d/%y %I:%M:%S %P")
| makemv delim="########" MSADChanges
| makemv delim="|" Session_Time
| table displayName,src_user,adminuser,Session_Time,msad_action,Correlation_IDs,MSADChanges</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="tok_domain" searchWhenChanged="true">
      <label>Account Domain</label>
      <search>
        <query>| inputlookup AD_Obj_Domain | stats count by domain |sort domain | table domain</query>
      </search>
      <fieldForLabel>domain</fieldForLabel>
      <fieldForValue>domain</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
    <input type="dropdown" token="tok_src_user" searchWhenChanged="true">
      <label>Administrator</label>
      <search base="base_gpo_chg_search">
        <query>stats count by src_user,adminuser | sort adminuser | table src_user,adminuser</query>
      </search>
      <fieldForLabel>adminuser</fieldForLabel>
      <fieldForValue>src_user</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <choice value="all">All</choice>
      <default>all</default>
      <initialValue>all</initialValue>
      <change>
        <condition value="all">
          <set token="tok_src_user_search"></set>
        </condition>
        <condition>
          <set token="tok_src_user_search">src_user="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="tok_gpo" searchWhenChanged="true">
      <label>Group Policy Name</label>
      <search base="base_gpo_chg_search">
        <query>search $tok_src_user_search$ | stats count by displayName | sort displayName | table displayName</query>
      </search>
      <fieldForLabel>displayName</fieldForLabel>
      <fieldForValue>displayName</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <choice value="all">All</choice>
      <default>all</default>
      <initialValue>all</initialValue>
      <change>
        <condition value="all">
          <set token="tok_src_gpo_search"></set>
        </condition>
        <condition>
          <set token="tok_src_gpo_search">displayName="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="time" token="Time">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Group Policy Edits</title>
        <search base="base_gpo_chg_search">
          <query>search $tok_src_user_search$ $tok_src_gpo_search$
| rename adminuser as "Administrator",msad_action as "Action",displayName as "GPO Name",MSADChanges as "Changes"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <drilldown>
          <link>
            <![CDATA[
            /app/ms_windows_ad_objects/ms_obj_ad_audit_gpo?form.tok_domain=$row.domain$&form.tok_gpo=$click.value$
            ]]>
          </link>
        </drilldown>        
      </table>
    </panel>
  </row>
</form>