<form script="customized_chart_preload.js,ms_ad_obj_audit_report.js" version="1.1">
  <label>AD Objects - Group - Audit</label>
  <init>
    <set token="dd_enable_search">True</set>
    <set token="tok_show_select_msg">true</set>
  	 <condition match=" $tok_group_dd$ !='' ">
		  <set token="tok_bypass_min">1000</set>
		  <set token="tok_results_max">9000</set>
		  <set token="tok_message_color">green</set>
		  <set token="tok_message_state">Info:</set>
		  <set token="tok_message">1: Select the Domain for the Target Group</set>
		  <set token="tok_user_lkp">AD_Obj_User</set>
		  <set token="tok_group_lkp">AD_Obj_Group</set>
		  <set token="tok_computer_lkp">AD_Obj_Computer</set>
    </condition>
    <condition>
		  <unset token="tok_tgr_bs_login_search"></unset>
		  <unset token="tok_tgr_bs_dom_group"></unset>
		  <unset token="tok_tgr_sub_non_dom_logon_filt"></unset>
		  <unset token="show_user_filt_dom"></unset>
		  <unset token="show_user_filt_non_dom"></unset>
		  <set token="tok_bypass_min">1000</set>
		  <set token="tok_results_max">9000</set>
		  <set token="tok_message_color">green</set>
		  <set token="tok_message_state">Info:</set>
		  <set token="tok_message">1: Select the Domain for the Target Group.</set>
		  <set token="tok_user_lkp">AD_Obj_User</set>
		  <set token="tok_group_lkp">AD_Obj_Group</set>
		  <set token="tok_computer_lkp">AD_Obj_Computer</set>
		  <set token="tok_domain_ad_group"></set>
    </condition>
  </init>
<!-- Base Domain List Search -->
  <search id="base_domain_search">
    <query>| `ms_obj_domain_list`</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <unset token="show_inputs"></unset>
        <set token="show_domain_warn">True</set>
      </condition>
      <condition>
        <unset token="show_domain_warn"></unset>
        <set token="show_inputs">True</set>
      </condition>
    </done>
  </search>
  <search base="base_domain_search" id="dom_lkp_vals">
    <query>search domain="$tok_domain$"</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <set token="tok_user_lkp">AD_Obj_User</set>
        <set token="tok_group_lkp">AD_Obj_Group</set>
        <set token="tok_computer_lkp">AD_Obj_Computer</set>
        <set token="tok_kv_suffix"></set>
        <set token="tok_dc_val">*</set>
      </condition>
      <condition>
        <set token="tok_user_lkp">$result.user_lookup$</set>
        <set token="tok_group_lkp">$result.group_lookup$</set>
        <set token="tok_computer_lkp">$result.computer_lookup$</set>
        <set token="tok_kv_suffix">$result.kv_suffix$</set>
        <set token="tok_dc_val">$result.dc_val$</set>
      </condition>
    </done>
  </search>
  <!-- Base Domain Group Lookup -->
  <search id="bs_dom_group">
    <query> | `ms_obj_ss_filt_pre_lkp("$tok_group_lkp$","$tok_domain$","$tok_group_filter$","cn,sAMAccountName,dn","domain,cn,sAMAccountName,dn,isDeleted,membercount,deletedDate,_key")`
| eval dom_srch_trigger="$tok_tgr_bs_dom_group$",key_val=_key</query>
  </search>
  <!-- Check Matching Results Count - Prevent Search if beyond $tok_results_max$, warn if under $tok_results_max$ but above $tok_bypass_min$.  This prevents slowness when building the Domain Group List -->
  <search base="bs_dom_group" id="sub_check_size_res">
    <query>| fields 
| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)`
| eval show_bypass_option=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"true","false")
| eval show_group_list=if(count&gt;=$tok_bypass_min$,"false","true")
| eval inp_bypass_nmb=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"2","false")
| eval inp_grp_lst_nmb=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"5","4")
| eval msg_state=if(count&gt;=$tok_bypass_min$,"Warning","Info")
| eval msg_color=if(count&gt;=$tok_bypass_min$,"red","green")
| eval msg=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,inp_grp_lst_nmb.": ".count." Total Groups matched the \"Filter Group\" ($tok_group_filter$). Either update the \"Filter Group\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow List Results Possible).",if(count&gt;=$tok_results_max$,inp_grp_lst_nmb.": ".count." Total Groups matched the \"Filter User\" ($tok_group_filter$). Update the \"Filter User\" to reduce the matching count.",inp_grp_lst_nmb.": (".count." Groups) Select an individual group account from the \"Select Group\" input."))
</query>
    <done>
      <condition match="$result.count$>0">
        <eval token="tok_show_bypass_option">if($result.show_bypass_option$=="false",NULL,"true")</eval>
        <eval token="tok_show_group_list">if($result.show_group_list$=="false",NULL,"true")</eval>
        <eval token="tok_tgr_sub_group_list">if($result.show_user_list$=="false",NULL,"true")</eval>
        <set token="tok_filt_group_cnt">$result.count$</set>
        <set token="tok_inp_grp_filt_nmb">3</set>
        <set token="tok_inp_bypass_nmb">$result.inp_bypass_nmb$</set>
        <set token="tok_inp_grp_list_nmb">$result.inp_grp_lst_nmb$</set>
        <set token="tok_message_color">$result.msg_color$</set>
        <set token="tok_message_state">$result.msg_state$</set>
        <set token="tok_message">$result.msg$</set>
        <set token="tok_group_msg_label">\26A0\0020Use to reduce Group list from $result.count$</set>
        <unset token="tok_tgr_post_check"></unset>
      </condition>   
      <condition match="$result.count$==0">
      	<set token="tok_filt_group_cnt">$result.count$</set>
        <set token="tok_tgr_post_check">true</set>
        <set token="tok_group_msg_label">\26A0\0020Use to reduce Group list from $result.count$</set>
      </condition>
    </done>
  </search>
  <search id="empty_check_size_res">
  	<query>| makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_group$",count=$tok_filt_group_cnt$</query>
    <done>   
      <condition match="$result.count$==0">
        <unset token="tok_show_bypass_option"></unset>
        <unset token="tok_tgr_sub_group_list"></unset>
        <unset token="tok_show_group_list"></unset>
        <unset token="tok_filt_group_cnt"></unset>
        <set token="tok_message_color">red</set>
        <set token="tok_message_state">Warning:</set>
        <set token="tok_message">2: No Groups found matching the "Filter Group" ($tok_group_filter$) entry. Update the "Filter Group" to return values. Note: You can use wildcards, (ex. al*), cannot enter ONLY a *.</set>
      </condition>
    </done>
  </search>
<!-- Search to populate Domain Group Lists -->
  <search base="bs_dom_group" id="sub_group_list">
    <query>search isDeleted="$tok_deleted$"
| eval trigger_sub_group_list="$tok_tgr_sub_group_list$"
| eval label=if(isnull(cn),sAMAccountName,cn)
| eval srt_field=case(isDeleted="TRUE" AND membercount="0",0,isDeleted="TRUE" AND membercount!="0",1,isDeleted="FALSE" AND membercount="0",2,isDeleted="FALSE" AND membercount!="0",3)
| eval label=if(isDeleted="TRUE","Deleted: ".label." (".membercount.")",label." (".membercount.")")
| eval key_val=_key
| stats count by label,key_val,srt_field  
| sort srt_field</query>
  </search>  
<!-- LDAP View Search -->
  <search id="base_audit_search_bs">
    <query>| inputlookup $tok_group_lkp$ WHERE domain="$tok_domain$" AND $tok_pre_filt_flds$="$tok_sel_group_filt$"
| makemv delim="|" objectClass
| makemv delim=" " userAccountControl
| makemv delim="####" dSCorePropagationData
| fields *</query>
    <earliest>0</earliest>
    <latest>now</latest>
    <done>
      <set token="tok_show_group_results">true</set>
    </done>
  </search>
  <search id="audit_query" base="base_audit_search_bs">
    <query>lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf
| lookup $tok_group_lkp$ primaryGroupToken AS primaryGroupID OUTPUT dn AS p_memberOf
| eval memberOf=mvappend(memberOf,p_memberOf)
| eval dn=lower(dn)
| eval group_name=if(isnull(cn),sAMAccountName,cn)
| fillnull value="" cn,dn,sAMAccountName
| fields *</query>
    <done>
      <set token="tok_group_dn">$result.dn$</set>
      <set token="tok_group_cn">$result.cn$</set>
      <set token="tok_group_nm">$result.group_name$</set>
      <set token="tok_group">$result.sAMAccountName$</set>
      <set token="tok_group_gchange_srch_url">`ms_obj_changes_base_cat("Group")` $tok_domain$ $tok_filt_raw_txt$
| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category))
| search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$"))
| `ms_obj_md_group_change_out("$tok_group_lkp$")`</set>
      <set token="tok_group_gmchange_srch_url">`ms_obj_changes_base_cat("Group Membership")` $tok_domain$ $tok_filt_raw_txt$
| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category))
| search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$"))
| `ms_obj_md_group_m_change_out("$tok_group_lkp$","$tok_user_lkp$","$tok_computer_lkp$")`</set>
    </done>
  </search>
<!-- Create Group Search Filters -->
  <search id="sub_dom_logon_filt">
    <query>| makeresults
| eval exec_trigger="$tok_tgr_sub_group_list$"
| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`])"
| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`"
| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])"
| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])"
| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl</query>
  <done>
    <condition match=" 'job.resultCount' == 0">
      <unset token="tok_filt_raw_txt"></unset>
      <unset token="tok_filt_link"></unset>
      <unset token="tok_filt_link_r_evt"></unset>
      <unset token="tok_tgr_bs_login_search"></unset>
    </condition>
    <condition>    
      <set token="tok_filt_raw_txt">$result.filt_raw_text$</set>
      <set token="tok_filt_link">$result.filt_link$</set>
      <set token="tok_filt_link_r_evt">$result.filt_link_r_evt$</set>
      <set token="tok_srch_filt_raw">$result.filt_raw_text_lbl$</set>
    </condition>
  </done>
  </search>  
  <search base="audit_query" id="sub_group_members">
    <query>fields member
| mvexpand member
| lookup $tok_user_lkp$ dn AS member OUTPUT sAMAccountName AS u_sAMAccountName,dn AS u_dn,cn AS u_cn,domain AS u_domain
| lookup $tok_group_lkp$ dn AS member OUTPUT sAMAccountName AS g_sAMAccountName,dn AS g_dn,cn AS g_cn,domain AS g_domain
| lookup $tok_computer_lkp$ dn AS member OUTPUT sAMAccountName AS c_sAMAccountName,dn AS c_dn,cn AS c_cn,domain AS c_domain
| table member,u_sAMAccountName,g_sAMAccountName,c_sAMAccountName,u_dn,g_dn,c_dn,u_cn,g_cn,c_cn,u_domain,g_domain,c_domain</query>
  </search>
  <search base="sub_group_members" id="filt_u_members">
    <query>fields u_sAMAccountName,u_dn,u_cn,u_domain
| search u_sAMAccountName=*
| sort u_domain,u_cn, u_sAMAccountName,u_dn
| table u_domain,u_cn, u_sAMAccountName,u_dn</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_user_member_msg">True</set>
        <unset token="show_user_member_table"></unset>
      </condition>
      <condition>
        <set token="show_user_member_table">True</set>
        <unset token="show_user_member_msg"></unset>
      </condition>
    </done>
  </search>
  <search base="sub_group_members" id="filt_g_members">
    <query>fields g_sAMAccountName,g_dn,g_cn,g_domain
| search g_sAMAccountName=*
| sort g_domain,g_cn, g_sAMAccountName,g_dn
| table g_domain,g_cn, g_sAMAccountName,g_dn</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_group_member_msg">True</set>
        <unset token="show_group_member_table"></unset>
      </condition>
      <condition>
        <set token="show_group_member_table">True</set>
        <unset token="show_group_member_msg"></unset>
      </condition>
    </done>
  </search>
  <search base="sub_group_members" id="filt_c_members">
    <query>fields c_sAMAccountName,c_dn,c_cn,c_domain
| search c_sAMAccountName=*
| sort c_domain,c_cn, c_sAMAccountName,c_dn
| table c_domain,c_cn, c_sAMAccountName,c_dn</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_computer_member_msg">True</set>
        <unset token="show_computer_member_table"></unset>
      </condition>
      <condition>
        <set token="show_computer_member_table">True</set>
        <unset token="show_computer_member_msg"></unset>
      </condition>
    </done>
  </search>
  <search base="bs_dom_group" id="sub_filtered_group">
    <query>search isDeleted="$tok_deleted$"
| eval sAMAccountName=lower(sAMAccountName)
| eval cn=if(deletedDate=="0",cn." ( ".mvindex(domain,0)." )",orig_cn." (Deleted - ".domain.")")
| eventstats count
| stats max(count) AS count by sAMAccountName,cn
| eval add_filter=if(count&gt;9999,"true",if(count&lt;1000,"false","empty"))
| eval count=tostring(count,"commas")
| table count,sAMAccountName,cn,add_filter
| sort cn</query>
    <finalized>
      <condition match="'result.add_filter'==&quot;true&quot;">
        <set token="tok_group_list_msg">\0020\26A0\0020\0020  Filter to below 10,000 ( $result.count$ )</set>
        <eval token="tok_group_list_label_msg">"( ".toString($result.count$,"commas")."  ) filtered groups"</eval>
        <set token="tok_group_list_label_msg">( $result.count$</set>
        <set token="tok_group_list_msg_color">red</set>
        <set token="tok_group_msg_color">red</set>
      </condition>
      <condition match="'result.add_filter'==&quot;false&quot;">
        <set token="tok_group_list_msg"></set>
        <eval token="tok_group_list_label_msg">"( ".toString($result.count$,"commas")."  ) filtered groups"</eval>
        <set token="tok_group_list_msg_color">green</set>
        <set token="tok_group_msg_color">green</set>
      </condition>
    </finalized>
  </search>
  <search id="base_member_of_search">
    <query>| inputlookup $tok_group_lkp$ WHERE member="$tok_group_dn$"
| fields cn,dn,sAMAccountName,MSADGroupClass,MSADGroupType
| eval memberOf_group=if(isnull(cn),sAMAccountName,cn." (".sAMAccountName.")")
| eval memberOf_group_dn=dn,memberOf_group_class=MSADGroupClass,memberOf_group_type=MSADGroupType
| table memberOf_group,memberOf_group_dn,memberOf_group_class,memberOf_group_type</query>
      <done>
        <condition match=" 'job.resultCount' == 0">
          <set token="show_group_memberOf_msg">True</set>
          <unset token="show_group_memberOf_table"></unset>
        </condition>
        <condition>
          <set token="show_group_memberOf_table">True</set>
          <unset token="show_group_memberOf_msg"></unset>
        </condition>
      </done>
  </search>
  <!-- Base Search for getting select Group - Group, Group Membership Change Events -->
  <search id="base_ug_chg_search">
    <query>`ms_obj_win_events_security`
[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="Group" OR change_category="Group Membership"
    | stats values(EventCode) AS EventCode by obj_type
    | format
    | table search] src_user_type="user" $tok_domain$ $tok_filt_raw_txt$
| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam
| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category))
| eval member_obj_lkp=trim(member_obj_lkp)
| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL)
| eval user_obj_lkp=if(obj_type="user",if(isnull(user),if(isnull(user_obj_dn),if(isnull(user_obj_email),if(isnull(DN),if(isnull(Old_DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(Old_DN)),lower(DN)),lower(user_obj_email)),lower(user_obj_dn)),lower(user)),NULL)
| eval obj_val=mvappend(user_obj_lkp,group_obj_val)
| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action)
| table _time,adminuser,src_user,dir_svcs_action,group_obj_lkp,member_obj_lkp,user_obj_lkp,msad_action,obj_type,obj_val,signature,change_signature,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,MSADChangedAttributes,MSADGroupClass,MSADGroupClassID,MSADGroupType,user, user_obj_lkp,comp_obj_dn,comp_obj_sam,dest_nt_domain,src_nt_domain,change_category,Change_Actions,New_DN,Old_DN,
| stats values(*) AS * by _time,src_user,obj_val,msad_action,dir_svcs_action</query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
  </search>
<!--    Group Membership Changes -->
  <search base="base_ug_chg_search" id="sub_group_m_chg_srch">
    <query>search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$"))
| `ms_obj_md_group_m_change_out("$tok_group_lkp$","$tok_user_lkp$","$tok_computer_lkp$")`</query>
    <progress>
      <condition>
        <unset token="show_group_gmchange_msg"></unset>
        <unset token="show_group_gmchange_table"></unset>
        <eval token="tok_group_gmchange_state">$job.dispatchState$</eval>
        <set token="show_group_gmchange_run">True</set>show_group_gmchange_msg
        <set token="tok_group_gmchange_color">blue</set>
      </condition>
    </progress>
    <done>      
      <condition match=" 'job.resultCount' == 0">
        <unset token="show_group_gmchange_run"></unset>
        <set token="show_group_gmchange_msg">True</set>
        <unset token="show_group_gmchange_table"></unset>
      </condition>
      <condition>
        <unset token="show_group_gmchange_run"></unset>
        <set token="show_group_gmchange_table">True</set>
        <unset token="show_group_gmchange_msg"></unset>
      </condition>
    </done>
  </search>
<!--    Group Changes -->
  <search base="base_ug_chg_search" id="sub_group_chg_srch">
          <query>search obj_type="group" change_category="Group" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$"))
| `ms_obj_md_group_change_out("$tok_group_lkp$")`</query>
    <progress>
      <condition>
        <unset token="show_group_gchange_msg"></unset>
        <unset token="show_group_gchange_table"></unset>
        <eval token="tok_group_gchange_state">$job.dispatchState$</eval>
        <set token="show_group_gchange_run">True</set>
        <set token="tok_group_gchange_color">blue</set>
      </condition>
    </progress>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <unset token="show_group_gchange_run"></unset>
        <set token="show_group_gchange_msg">True</set>
        <unset token="show_group_gchange_table"></unset>
      </condition>
      <condition>
        <unset token="show_group_gchange_run"></unset>
        <set token="show_group_gchange_table">True</set>
        <unset token="show_group_gchange_msg"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false" autoRun="true">
  </fieldset>
  <row id="rw_initial_filters">
    <panel id="pan_initial_inputs">
      <input type="dropdown" token="tok_sel_domain" searchWhenChanged="true">
        <label>1. Select Domain</label>
        <choice value="sel">Select Domain...</choice>
        <initialValue>sel</initialValue>
        <default>sel</default>
        <search base="base_domain_search">
          <query>table domain | sort domain</query>
        </search>
        <fieldForLabel>domain</fieldForLabel>
        <fieldForValue>domain</fieldForValue>
        <change>
          <condition value="sel">
            <unset token="show_obj_filt"></unset>
          </condition>
          <condition>
            <set token="tok_group_domain_add">False</set>
            <set token="tok_domain">$value$</set>
            <set token="tok_domain_srch">domain="$value$"</set>
            <set token="tok_domain_grp_srch">domain="$value$" AND</set>
            <set token="show_obj_filt">True</set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">2: Enter a group filter in the "Filter Group" input. Note: This filter will look through the "CN, sAMAccountName, and distinguishedName" to filter "Select Group" dropdown list. You can use wildcards, cannot enter ONLY a "*".</set>
          </condition>
        </change>
      </input>
        <input type="text" token="tok_group_filter_bs" searchWhenChanged="true" depends="$show_obj_filt$">
          <label>2: Pre-Filter Group List</label>
          <initialValue></initialValue>
          <change>
            <condition match="len($value$)>0">
              <set token="tok_group_filter">$value$</set>
              <set token="tok_show_inc_del">True</set>
              <set token="tok_tgr_bs_dom_group">True</set>
            </condition>
            <condition>
              <unset token="tok_group_filter"></unset>
              <unset token="tok_show_inc_del"></unset>
            <unset token="tok_exec_search"></unset>
            <unset token="tok_group_filter"></unset>
            <unset token="show_group_dropdown"></unset>
            <unset token="tok_tgr_bs_dom_group"></unset>
            <set token="form.tok_group"></set>
            </condition>
          </change>
        </input>
      <input id="init_filt_radio_inc_del" type="radio" token="tok_deleted" searchWhenChanged="true" depends="$tok_show_inc_del$">
        <label>3. Include Deleted</label>
        <choice value="False">No</choice>
        <choice value="*">Yes</choice>
        <default>False</default>
        <initialValue>False</initialValue>
      </input>
      <input id="init_filt_radio_bypass" type="radio" token="tok_bypass_lg" depends="$tok_show_bypass_option$">
        <label>4. Bypass Large List</label>
        <choice value="no">No</choice>
        <choice value="yes">Yes</choice>
        <default>no</default>
        <initialValue>no</initialValue>
        <change>
          <condition value="no">
            <unset token="tok_tgr_sub_group_list"></unset>
            <unset token="tok_show_group_list"></unset>
          </condition>
          <condition value="yes">
            <set token="tok_tgr_sub_group_list">true</set>
            <set token="tok_show_group_list">true</set>
          </condition>
        </change>
      </input>
      <input id="input_group_list" type="dropdown" token="inp_tok_group" searchWhenChanged="true" depends="$tok_show_group_list$">
        <label>$tok_inp_grp_list_nmb$. Select Group</label>
        <choice value="sel">Select...</choice>
        <default>sel</default>
        <initialValue>sel</initialValue>
        <search base="sub_group_list" id="group_list">
          <query></query>
        </search>
        <fieldForLabel>label</fieldForLabel>
        <fieldForValue>key_val</fieldForValue>
        <change>
          <condition value="sel">
            <unset token="tok_sel_group_filt"></unset>
            <unset token="tok_show_tabs"></unset>
            <set token="tok_show_select_msg">true</set>
            <unset token="tok_show_group_results"></unset>
          </condition> 
          <condition>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_result_msg"></unset>
            <set token="tok_sel_group_filt">$value$</set>
            <set token="tok_pre_filt_flds">_key</set>
            <set token="atok_sel_group_filt">search _key="$value$"</set>
            <set token="tok_message_color"></set>
            <set token="tok_message_state"></set>
            <set token="tok_message"></set>
            <unset token="tok_show_select_msg"></unset>
          </condition>
        </change>
      </input>
      <input type="time" token="Time" depends="$tok_show_group_list$">
        <label>Select Time for Activity</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
      <html depends="$tok_message_state$" id="inp_msg">
        <p style="font-size:8;" id="inp_msg_p">
          <font color="$tok_message_color$">
            <i>
              <b>$tok_message_state$ </b> $tok_message$</i> 
          </font>
        </p>
      </html>
    </panel>
  </row>
  <row depends="$tok_show_select_msg$">
    <panel>
      <html>
        <center><h3><i class="icon-info-circle" style="font-size:25px;color:blue;" /> Use the above Filters to create a list of Groups and then Select an individual Group to view Audit Details</h3></center>
      </html>
    </panel>
  </row>
  <row depends="$tok_show_group_results$">
    <panel id="ldap_details_report">
      <title>AD LDAP Details for Group ($tok_group_nm$)</title>
      <html>
        <div id="audit_report"/>
      </html>
    </panel>
    <panel id="result_details_pan">
      <html depends="$show_user_member_msg$" id="result_details_msg_ugrp_m">
        <center>
          <h3>No User Account Members in the Group ($tok_group_nm$)</h3>
        </center>
      </html>
      <table depends="$show_user_member_table$" id="result_details_tbl_ugrp_m">
        <title>$tok_group_nm$ - Group Membership - User Accounts</title>
        <search base="filt_u_members">
          <query>rename u_domain AS "Member Domain",u_cn AS Member, u_sAMAccountName AS "Member Account", u_dn AS "Member DN"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>
      <html depends="$show_group_member_msg$" id="result_details_msg_ggrp_m">
        <center>
          <h3>No Embedded Group Members in the Group ($tok_group_nm$)</h3>
        </center>
      </html>
      <table depends="$show_group_member_table$" id="result_details_tbl_ggrp_m">
        <title>$tok_group_nm$ - Group Membership - Embedded Groups</title>
        <search base="filt_g_members">
          <query>rename g_domain AS "Member Domain",g_cn AS Member, g_sAMAccountName AS "Member Account", g_dn AS "Member DN"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>
      <html depends="$show_computer_member_msg$" id="result_details_msg_cgrp_m">
        <center>
          <h3>No Computer Account Members in the Group ($tok_group_nm$)</h3>
        </center>
      </html>
      <table depends="$show_computer_member_table$" id="result_details_tbl_cgrp_m">
        <title>$tok_group_nm$ - Group Membership - Computers</title>
        <search base="filt_c_members">
          <query>rename c_domain AS "Member Domain",c_cn AS Member, c_sAMAccountName AS "Member Account", c_dn AS "Member DN"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>
      <html depends="$show_group_memberOf_msg$" id="result_details_msg_eggrp_m">
        <center>
          <h3>This Group ($tok_group_nm$) is not Embedded in any other Groups</h3>
        </center>
      </html>
      <table depends="$show_group_memberOf_table$" id="result_details_tbl_eggrp_m">
        <title>Groups that the Group ($tok_group_nm$) are a memberOf</title>
        <search base="base_member_of_search">
          <query></query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>
      <html depends="$show_group_gmchange_run$" id="result_details_run_chg_grp_m">
        <center><h3><img class="run_spin run_spin_dom_chk hidden" style="height:20px;width:20px;" src="/static/app/ms_windows_ad_objects/loader_green_on_grey.gif"></img> Group Membership Changes Search ($tok_group_gmchange_state$)</h3></center>
      </html>
      <html depends="$show_group_gmchange_msg$" id="result_details_msg_chg_grpm">
        <center><h3><i class="icon-info-circle" style="font-size:25px;color:blue;" /> No Group Membership Changes found for Group ($tok_group_nm$)
        <a href="/app/ms_windows_ad_objects/search?q=$tok_group_gmchange_srch_url|u$&amp;earliest=$Time.earliest$%40h&amp;latest=$Time.latest$" class="btn mini sp-btn-gradient" target="_blank">Review Search</a></h3></center>
      </html>
      <table depends="$show_group_gmchange_table$" id="result_details_tbl_gmchg">
        <title>Group Membership Changes</title>
        <search base="sub_group_m_chg_srch">
          <query>table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details
| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">5</option>
      </table>
      <html depends="$show_group_gchange_run$" id="result_details_run_chg_grp">
        <center><h3><img class="run_spin run_spin_dom_chk hidden" style="height:20px;width:20px;" src="/static/app/ms_windows_ad_objects/loader_green_on_grey.gif"></img> Group Changes Search ($tok_group_gchange_state$)</h3></center>
      </html>
      <html depends="$show_group_gchange_msg$" id="result_details_msg_chg_grp">
        <center><h3><i class="icon-info-circle" style="font-size:25px;color:blue;" /> No Group Changes found for Group ($tok_group_nm$)  
        <a href="/app/ms_windows_ad_objects/search?q=$tok_group_gchange_srch_url|u$&amp;earliest=$Time.earliest$%40h&amp;latest=$Time.latest$" class="btn mini sp-btn-gradient" target="_blank">Review Search</a></h3></center>
      </html>
      <table depends="$show_group_gchange_table$" id="result_details_tbl_chg_grp">
        <title>Group Changes</title>
        <search base="sub_group_chg_srch">
          <query>table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details
| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">5</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <style>
#rw_initial_filters {border: 4px solid #e20082;}
#pan_initial_inputs-fieldset {padding: 0px 12px 0px 12px !important;}
#pan_initial_inputs .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;width: 100% !important;border: 2px solid #e20082;}
[id^="init_filt_radio_"] .splunk-radiogroup {height:20px !important;}
[id^="init_filt_radio_"] .splunk-radiogroup div div div {padding-top:0px !important;}
#input_group_filter_list {line-height: 15px !important;}
#input_group_filter_list::after {content: '$tok_group_msg_label$';font-style: italic !important;font-size: 10px !important;color:$tok_group_msg_color$ !important;display: inline-block;width: 100%;}
#input_group_list.select2-drop-mask {padding: 0 0 0 0 !important;padding-bottom: 50px !important;margin: 0 0 0 0 !important;width: 100% !important;}
#input_group_list {line-height: 1px;width:300px !important;padding-right: 20px !important;margin-right: 20px !important;            }
[id^="input_group_list_"] [data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] {width: 275px !important; padding-right:20px !important;margin-right:20px !important;display: flex;  }
#input_group_list::after {content: '$tok_group_list_msg$';font-style: italic !important;font-size: 10px !important;color:$tok_group_list_msg_color$ !important;display: inline-block;width: 100% !important;}
#input_group_list label::after {content: '\0020$tok_group_list_label_msg$';font-style: italic !important;font-size: 10px !important;color:$tok_group_list_msg_color$ !important;      }
.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;}
.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF)}
[id^="result_details_pan"] {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
[id^="result_details_pan"] .panel-element-row {width:99.2% !important;}
[id^="result_details_tbl_"] {border: 2px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
[id^="result_details_msg_"] {border: 2px solid #e20082;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
[id^="result_details_run_"] {border: 2px solid #e20082;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
[id^="ldap_details_"] {border: 4px solid #f99d1c;width:48% !important;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
[id^="ldap_details_"] .dashboard-panel h2.panel-title {font-weight: bold !important;}          
        </style>
      </html>
    </panel>
  </row>
</form>