<form stylesheet="ms_ad_obj_gbl_tabs.css" version="1.1">
  <label>AD Objects - Admin - Logins - Ratio</label>
  <init>
    <set token="dd_enable_search">True</set>
    <unset token="tok_tgr_bs_login_search"></unset>
    <unset token="tok_tgr_bs_dom_user"></unset>
    <unset token="tok_tgr_sub_non_dom_logon_filt"></unset>
    <unset token="show_user_filt_dom"></unset>
    <unset token="show_user_filt_non_dom"></unset>
    <set token="tok_bypass_min">50</set>
    <set token="tok_results_max">600</set>
    <set token="tok_message_color">green</set>
    <set token="tok_message_state">Info:</set>
    <set token="tok_message">1: Select the Domain Status of the user.</set>
    <set token="tok_user_lkp">AD_Obj_User</set>
    <set token="tok_group_lkp">AD_Obj_Group</set>
    <set token="tok_computer_lkp">AD_Obj_Computer</set>
    <set token="show_filters">active</set>
    <unset token="tok_show_dom_filter_opt"></unset>
  </init>
  <search id="dom_stat_vals">
    <query>| makeresults
| eval d_st_type="$tok_user_domain_acct_bs$"
| eval dom_stat=case(d_st_type=="all","",d_st_type=="False","(Sub_Status=0xC0000064 OR Error_Code=0xC0000064)",d_st_type=="True","NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064")
</query>
    <done>
      <set token="tok_domain_acct">$result.dom_stat$</set>
    </done>
  </search>
  <search id="bs_dom_list">
    <query>| `ms_obj_domain_list`</query>
  </search>
  <search base="bs_dom_list" id="dom_lkp_vals">
    <query>search domain="$tok_domain_ad_user$"
| eval dom_lkp_srch_trigger="$show_dom_acc$"
| eval tok_lkp_filt=if(multi_lkps_enabled=="t","User_".kv_suffix,"User")</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <set token="tok_user_lkp">AD_Obj_User</set>
        <set token="tok_group_lkp">AD_Obj_Group</set>
        <set token="tok_computer_lkp">AD_Obj_Computer</set>
        <set token="tok_lkp_filt">User</set>
      </condition>
      <condition>
        <set token="tok_user_lkp">$result.user_lookup$</set>
        <set token="tok_group_lkp">$result.group_lookup$</set>
        <set token="tok_computer_lkp">$result.computer_lookup$</set>
        <set token="tok_lkp_filt">$result.tok_lkp_filt$</set>
      </condition>
    </done>
  </search>
  <!-- Base Domain User Lookup -->
  <search id="bs_dom_user">
    <query> | `ms_obj_ss_filt_pre_lkp("$tok_user_lkp$","$tok_domain_ad_user$","$tok_user_filter$","cn,sAMAccountName,userPrincipalName","domain,cn,sAMAccountName,userPrincipalName,dn,_key")`
| eval dom_srch_trigger="$tok_tgr_bs_dom_user$",key_val=_key
</query>
  </search>
  <!-- Check Matching Results Count - Prevent Search if beyond $tok_results_max$, warn if under $tok_results_max$ but above $tok_bypass_min$.  This prevents slowness when building the Domain User List -->
  <search base="bs_dom_user" id="sub_check_size_res">
    <query>| fields 
| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)`
| eval show_bypass_option=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"true","false")
| eval show_user_list=if(count&gt;=$tok_bypass_min$,"false","true")
| eval inp_usr_lst_nmb=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"7","6")
| eval inp_post_filt_nmb=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,"8","7")
| eval msg_state=if(count&gt;=$tok_bypass_min$,"Warning","Info")
| eval msg_color=if(count&gt;=$tok_bypass_min$,"red","green")
| eval msg=if(count&gt;=$tok_bypass_min$ AND count&lt;=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow Search Possible).",if(count&gt;=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Update the \"Filter User\" to reduce the matching count.",inp_usr_lst_nmb.": (".count." Users) Either select a individual matching user account or \"All\" from the \"Select User\" input."))
</query>
    <done>
      <condition match="$result.count$&gt;0">
        <eval token="tok_show_bypass_option">if($result.show_bypass_option$=="false",NULL,"true")</eval>
        <eval token="tok_show_user_list">if($result.show_user_list$=="false",NULL,"true")</eval>
        <eval token="tok_tgr_sub_user_list">if($result.show_user_list$=="false",NULL,"true")</eval>
        <set token="tok_filt_user_cnt">$result.count$</set>
        <set token="tok_inp_usr_list_nmb">$result.inp_usr_lst_nmb$</set>
        <set token="tok_message_color">$result.msg_color$</set>
        <set token="tok_message_state">$result.msg_state$</set>
        <set token="tok_message">$result.msg$</set>
        <set token="tok_inp_post_filt_nmb">$result.inp_post_filt_nmb$</set>
        <unset token="tok_tgr_post_check"></unset>
      </condition>
      <condition match="$result.count$==0">
        <set token="tok_filt_user_cnt">$result.count$</set>
        <set token="tok_tgr_post_check">true</set>
      </condition>
    </done>
  </search>
  <search id="empty_check_size_res">
    <query>| makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_user$",count=$tok_filt_user_cnt$</query>
    <done>
      <condition match="$result.count$==0">
        <unset token="tok_show_bypass_option"></unset>
        <unset token="tok_tgr_sub_user_list"></unset>
        <unset token="tok_show_user_list"></unset>
        <unset token="tok_filt_user_cnt"></unset>
        <set token="tok_message_color">red</set>
        <set token="tok_message_state">Warning:</set>
        <set token="tok_message">5: No Users found matching the "Filter User" ($tok_user_filter$) entry. Update the "Filter User" to return values. Note: You can use wildcards, (ex. al*), however you cannot enter only a * to search for all.</set>
      </condition>
    </done>
  </search>
  <!-- Search to populate Domain User Lists -->
  <search base="bs_dom_user" id="sub_user_list">
    <query>eval trigger_sub_user_list="$tok_tgr_sub_user_list$"
| eval label=if(isnull(cn),sAMAccountName." (".domain." )",cn." (".domain." )")
| stats count by label,key_val 
| sort label</query>
  </search>
  <!-- Possible Speed Up - Places Raw Values instead of using a sub search
   <search base="bs_dom_user" id="sub_dom_logon_filt">
    <query>
 $tok_sel_user_filt$
| eval exec_trigger="$tok_tgr_sub_user_list$"     
| eval filt_vals=mvdedup(mvappend(cn,sAMAccountName,userPrincipalName)) 
| eval filt_link_add="cn=\"".cn."\" OR sAMAccountName=\"".sAMAccountName."\" OR userPrincipalName=\"".userPrincipalName."\""
| stats values(filt_vals) AS filt_vals,values(filt_link_add) AS filt_link_add 
| eval filt_vals=mvfilter(match(filt_vals,"^\S+"))
| eval filt_raw_text=if(mvcount(filt_vals)==1,"(\"".filt_vals."\")"," (\"".mvjoin(filt_vals,"\" OR \"")."\")")
| eval filt_link=if(mvcount(filt_vals)==1,"| search Logon_User IN(\"".filt_vals."\")","| search Logon_User IN([`ms_obj_ss_filt_raw_link(\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_user_filter$\",\"cn,sAMAccountName,principalName\",\"link\")`])")
| eval filt_link_r_evt=if(mvcount(filt_vals)==1,"| search user IN(\"".filt_vals."\")","| search user IN(\"".mvjoin(filt_vals,"\",\"")."\")"))
| eval filt_link_add=mvjoin(filt_link_add," OR ")
| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt</query>
</search>-->
  <search id="sub_dom_logon_filt">
    <query>| makeresults
| eval exec_trigger="$tok_tgr_sub_user_list$"
| eval filt_link_add="| join type=left Logon_User [|inputlookup $tok_user_lkp$ WHERE [|`ms_obj_ss_filt_pre_base(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\")`] | eval Logon_User=cn.\"|\".sAMAccountName.\"|\".userPrincipalName | makemv delim=\"|\" Logon_User | stats values(uac_details) AS uac_details by Logon_User | eval uac_details=mvjoin(uac_details,\":\")| table Logon_User, uac_details]
| eval uac_details=if(isnull(uac_details),\"Not Available\",uac_details) 
| makemv delim=\":\" uac_details"
| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`])"
| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`"
| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])"
| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])"
| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <unset token="tok_filt_raw_txt"></unset>
        <unset token="tok_filt_link"></unset>
        <unset token="tok_filt_link_add"></unset>
        <unset token="tok_filt_link_r_evt"></unset>
        <unset token="tok_tgr_bs_login_search"></unset>
      </condition>
      <condition>
        <set token="tok_filt_raw_txt">$result.filt_raw_text$</set>
        <set token="tok_filt_link">$result.filt_link$</set>
        <set token="tok_filt_link_add">$result.filt_link_add$</set>
        <set token="tok_filt_link_r_evt">$result.filt_link_r_evt$</set>
        <set token="tok_srch_filt_raw">$result.filt_raw_text_lbl$</set>
      </condition>
    </done>
  </search>
  <!-- Filter Creation Search - Non - Domain Accounts - Using Selected Input Vales to build filters for the logon search -->
  <search id="sub_non_dom_logon_filt">
    <query>| makeresults 
| eval non_dom_filt_srch_trigger="$tok_tgr_sub_non_dom_logon_filt$"
| eval filt_raw_text=if(match("$tok_user_filter$","^\*$$"),"","\"$tok_user_filter$\"")
| eval filt_link=if(match("$tok_user_filter$","^\*$$"),"","| search Logon_User=\"$tok_user_filter$\"")
| eval filt_link_r_evt=if(match("$tok_user_filter$","^\*$$"),"","| search user=\"$tok_user_filter$\"")
| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <unset token="tok_filt_raw_txt"></unset>
        <unset token="tok_filt_link"></unset>
        <unset token="tok_filt_link_add"></unset>
        <unset token="tok_filt_link_r_evt"></unset>
        <unset token="tok_tgr_bs_login_search"></unset>
      </condition>
      <condition>
        <set token="tok_filt_raw_txt">$result.filt_raw_text$</set>
        <set token="tok_filt_link">$result.filt_link$</set>
        <set token="tok_filt_link_add"></set>
        <set token="tok_filt_link_r_evt">$result.filt_link_r_evt$</set>
      </condition>
    </done>
  </search>
  <!-- Logon Searches - Using Filters from the sub_dom_logon_filt search -->
  <search id="bs_login_search">
    <query>`ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$
| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code
| eval exec_logon_srch_trigger="$tok_tgr_bs_login_search$"
| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") 
| eval Logon_User=lower(user),status=if(status=="denied","failure",status) 
| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) 
| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####"))
| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain))
| eval session_id=if(isnull(session_id),_time,session_id)
| makemv delim="####" src_nt_host
| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason)
| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature 
| eval Session_Status="Audit ".status
| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account
$tok_filt_link$
| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0)
| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account
| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account
| eval Session_Host_Count=mvcount(Session_Hosts)
| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") 
| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") 
| eval Total_Attempts=sesscount 
| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2)
| sort 0 -Fail_Percent, -Total_Attempts 
| eval Success_Percent=round((success_count/Total_Attempts)*100,2)
| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account</query>
    <earliest>$time_field.earliest$</earliest>
    <latest>$time_field.latest$</latest>
    <progress>
      <unset token="tok_logon_srch_empty"></unset>
      <unset token="tok_message_color"></unset>
      <unset token="tok_message_state"></unset>
      <unset token="tok_message"></unset>
      <unset token="tok_show_tabs"></unset>
      <unset token="tok_result_msg"></unset>
      <set token="tok_logon_srch_run">true</set>
    </progress>
    <cancelled>
      <unset token="tok_logon_srch_run"></unset>
      <unset token="tok_logon_srch_run"></unset>
      <unset token="tok_show_tabs"></unset>
      <unset token="tok_tgr_bs_raw_login_search"></unset>
      <unset token="show_post_filters"></unset>
      <unset token="tok_hide_filters_btn"></unset>
    </cancelled>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <unset token="tok_logon_srch_run"></unset>
        <unset token="tok_show_tabs"></unset>
        <unset token="tok_tgr_bs_raw_login_search"></unset>
        <unset token="show_post_filters"></unset>
        <unset token="tok_hide_filters_btn"></unset>
        <set token="show_filters">active</set>
        <set token="tok_logon_srch_empty">true</set>
        <set token="tok_result_msg">true</set>
        <set token="tok_srch_bs_logon">`ms_obj_failed_success_logons("user")`
| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status</set>
        <set token="tok_srch_bs_logon_dom">`ms_obj_failed_success_logons("user")` $tok_domain_acct$</set>
        <set token="tok_srch_bs_logon_dom_filt">`ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$
| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status</set>
        <set token="tok_srch_bs_logon_full">`ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$
| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code
| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") 
| eval Logon_User=lower(user) 
| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) 
| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####"))
| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain))
| eval session_id=if(isnull(session_id),_time,session_id)
| makemv delim="####" src_nt_host
| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason)
| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature 
| eval Session_Status="Audit ".status
| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account $tok_filt_link$
| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0)
| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account
| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account
| eval Session_Host_Count=mvcount(Session_Hosts)
| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") 
| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") 
| eval Total_Attempts=sesscount 
| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2)
| sort 0 -Fail_Percent, -Total_Attempts 
| eval Success_Percent=round((success_count/Total_Attempts)*100,2)
| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account</set>
      </condition>
      <condition>
        <unset token="tok_logon_srch_empty"></unset>
        <unset token="tok_logon_srch_run"></unset>
        <unset token="tok_result_msg"></unset>
        <unset token="show_filters"></unset>
        <set token="tok_show_filters_btn">active</set>
        <set token="show_post_filters">True</set>
        <set token="tok_srch_bs_logon">`ms_obj_failed_success_logons("user")`
| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status</set>
        <set token="tok_srch_bs_logon_dom">`ms_obj_failed_success_logons("user")` $tok_domain_acct$</set>
        <set token="tok_srch_bs_logon_dom_filt">`ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$</set>
        <set token="tok_srch_bs_logon_full">`ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$
| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code
| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") 
| eval Logon_User=lower(user) 
| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) 
| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####"))
| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain))
| eval session_id=if(isnull(session_id),_time,session_id)
| makemv delim="####" src_nt_host
| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason)
| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature 
| eval Session_Status="Audit ".status
| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account $tok_filt_link$
| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0)
| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account
| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account
| eval Session_Host_Count=mvcount(Session_Hosts)
| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") 
| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") 
| eval Total_Attempts=sesscount 
| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2)
| sort 0 -Fail_Percent, -Total_Attempts 
| eval Success_Percent=round((success_count/Total_Attempts)*100,2)
| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account</set>
        <set token="tok_srch_logon_ratio_full">| search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$
| eval Fail_Percent=Fail_Percent."% (".tostring(fail_count,"commas").")"
| eval Success_Percent=Success_Percent."% (".tostring(success_count,"commas").")"
| eval Total_Attempts=tostring(Total_Attempts,"commas")
| table Domain,Logon_User, Domain_Account,Session_Host_Count, Total_Attempts, Fail_Percent, Success_Percent, First_Attempt, Last_Attempt</set>
        <set token="tok_show_tabs">true</set>
        <set token="tok_tab_1">active</set>
        <unset token="tok_tab_2"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row depends="$show_filters$" id="rw_initial_filters">
    <panel id="rw_initial_panel">
      <input type="time" token="time_field" searchWhenChanged="true">
        <label>1. Select Time Period</label>
        <default>
          <earliest>-4h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="radio" token="tok_user_domain_acct_bs" searchWhenChanged="true">
        <label>2: Domain Status</label>
        <choice value="True">Domain Account</choice>
        <choice value="False">Non-Domain Account</choice>
        <choice value="all">All</choice>
        <change>
          <condition value="True">
            <set token="show_dom_list">true</set>
            <unset token="tok_show_user_list"></unset>
            <unset token="tok_show_bypass_option"></unset>
            <unset token="tok_user_filter"></unset>
            <unset token="form.tok_user_filter_bs"></unset>
            <unset token="tok_user_filter_bs"></unset>
            <unset token="tok_filt_raw_txt"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="tok_tgr_bs_dom_user"></unset>
            <unset token="tok_tgr_sub_non_dom_logon_filt"></unset>
            <unset token="show_non_dom_acc"></unset>
            <unset token="show_all_acc"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="show_user_filt_non_dom"></unset>
            <unset token="show_user_filt_dom"></unset>
            <unset token="tok_tgr_sub_user_list"></unset>
            <set token="tok_show_dom_filter_opt">True</set>
            <set token="tok_domain">sel</set>
            <set token="form.tok_domain">sel</set>
            <set token="tok_user">sel</set>
            <set token="form.tok_user">sel</set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">3: Choose whether to use Domain Filters or not.</set>
            <set token="show_dom_acc">True</set>
            <set token="tok_domain_acct">NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064</set>
            <set token="tok_table_search">| table Logon_User, uac_details</set>
          </condition>
          <condition>
            <unset token="show_dom_list"></unset>
            <unset token="tok_show_user_list"></unset>
            <unset token="tok_show_bypass_option"></unset>
            <unset token="tok_sel_user_filt"></unset>
            <unset token="tok_user_filter"></unset>
            <unset token="tok_filt_raw_txt"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="tok_tgr_bs_dom_user"></unset>
            <unset token="tok_tgr_post_check"></unset>
            <unset token="tok_tgr_sub_user_list"></unset>
            <unset token="show_dom_acc"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="show_user_filt_dom"></unset>
            <unset token="tok_show_dom_filter_opt"></unset>
            <set token="form.tok_user_filter_non_dom_bs"></set>
            <set token="tok_user_filter_non_dom_bs"></set>
            <set token="show_user_filt_non_dom">True</set>
            <set token="tok_user_filter_non_dom_nbr">3</set>
            <set token="tok_tgr_sub_non_dom_logon_filt">$value$</set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">3: Enter a user filter in the "Filter User" input. Note: You can use wildcards, enter * to search for all logon users during specified time period.</set>
            <set token="tok_table_search">| table Logon_User</set>
            <set token="tok_domain_ad_user"></set>
            <set token="tok_inp_post_filt_nmb">4</set>
          </condition>
        </change>
      </input>
      <input type="radio" token="tok_dom_filt_bs" depends="$tok_show_dom_filter_opt$">
        <label>3. Use Domain Filters</label>
        <choice value="yes">Yes</choice>
        <choice value="no">No</choice>
        <change>
          <condition value="yes">
            <unset token="tok_domain_ad_user"></unset>
            <unset token="tok_filt_raw_txt"></unset>
            <unset token="tok_filt_link"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="show_user_filt_non_dom"></unset>
            <set token="tok_show_dom_filter">true</set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">4: Select a target AD Domain for the logon users.</set>
          </condition>
          <condition>
            <unset token="tok_show_dom_filter"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <set token="tok_domain_ad_user"></set>
            <set token="tok_filt_raw_txt"></set>
            <set token="tok_filt_link"></set>
            <set token="tok_domain_ad_user"></set>
            <set token="show_user_filt_non_dom">true</set>
            <set token="tok_user_filter_non_dom_nbr">4</set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">4: Enter a user filter in the "Filter User" input. Note: You can use wildcards, enter * to search for all logon users during specified time period.</set>
            <set token="tok_inp_post_filt_nmb">5</set>
          </condition>
        </change>
      </input>
      <input type="text" token="tok_user_filter_non_dom_bs" searchWhenChanged="true" depends="$show_user_filt_non_dom$">
        <label>$tok_user_filter_non_dom_nbr$: Filter User</label>
        <initialValue></initialValue>
        <change>
          <condition match="len($value$)&gt;0">
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_result_msg"></unset>
            <set token="tok_tgr_bs_login_search">True</set>
            <eval token="aatok_user_filter">if(len($value$)&gt;0,$value$,NULL)</eval>
            <set token="tok_user_filter">$value$</set>
            <set token="tok_message_color"></set>
            <set token="tok_message_state"></set>
            <set token="tok_message"></set>
            <set token="tok_logon_srch_run">true</set>
          </condition>
          <condition>
            <unset token="tok_exec_search"></unset>
            <unset token="tok_user_filter"></unset>
            <unset token="show_user_dropdown"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="tok_tgr_bs_dom_user"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
          </condition>
        </change>
      </input>
      <input type="dropdown" token="tok_domain" searchWhenChanged="true" depends="$tok_show_dom_filter$,$show_dom_list$">
        <label>4: Select Domain</label>
        <choice value="sel">Select Domain</choice>
        <initialValue>sel</initialValue>
        <default>sel</default>
        <search base="bs_dom_list">
          <query>fields domain | eval domain_val=lower(domain) | table domain,domain_val | search domain!="" | sort domain</query>
        </search>
        <fieldForLabel>domain</fieldForLabel>
        <fieldForValue>domain_val</fieldForValue>
        <change>
          <condition value="sel">
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="tok_domain_ad_user"></unset>
            <unset token="show_user_filt_dom"></unset>
            <unset token="tok_tgr_bs_dom_user"></unset>
            <unset token="tok_user_filter"></unset>
            <unset token="form.tok_user_filter_bs"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
          </condition>
          <condition>
            <unset token="tok_user_filter"></unset>
            <unset token="form.tok_user_filter_bs"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <set token="tok_user">sel</set>
            <set token="tok_tgr_bs_dom_user">True</set>
            <set token="tok_tgr_sub_user_list">True</set>
            <set token="tok_domain_ad_user">$value$</set>
            <set token="show_user_filt_dom"></set>
            <set token="tok_message_color">green</set>
            <set token="tok_message_state">Info:</set>
            <set token="tok_message">5: Enter a user filter in the "Filter User" input. Note: This filter will look through the "CN, sAMAccountName, and userPrincipalName" for matches and open the "Select User" dropdown list with matching results. You can use wildcards, however you cannot enter only a "*" to search for all.</set>
          </condition>
        </change>
      </input>
      <input type="text" token="tok_user_filter_bs" searchWhenChanged="true" depends="$tok_show_dom_filter$,$show_user_filt_dom$">
        <label>5: Filter Domain User</label>
        <initialValue></initialValue>
        <change>
          <condition value="">
            <unset token="tok_exec_search"></unset>
            <unset token="tok_user_filter"></unset>
            <unset token="show_user_dropdown"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <set token="tok_user">sel</set>
          </condition>
          <condition>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_tgr_bs_login_search"></unset>
            <set token="tok_user">sel</set>
            <set token="tok_user_filter">$value$</set>
          </condition>
        </change>
      </input>
      <input type="radio" token="tok_bypass_lg" depends="$tok_show_dom_filter$,$tok_show_bypass_option$">
        <label>6. Bypass Large List</label>
        <choice value="yes">Yes</choice>
        <change>
          <condition value="yes">
            <set token="tok_tgr_sub_user_list">true</set>
            <set token="tok_show_user_list">true</set>
          </condition>
          <condition>
            <unset token="tok_tgr_sub_user_list"></unset>
            <unset token="tok_show_user_list"></unset>
          </condition>
        </change>
      </input>
      <input type="dropdown" token="tok_user" searchWhenChanged="true" depends="$tok_show_dom_filter$,$tok_show_user_list$">
        <label>$tok_inp_usr_list_nmb$: Select User</label>
        <choice value="sel">Select...</choice>
        <choice value="all">All</choice>
        <default>sel</default>
        <initialValue>sel</initialValue>
        <search base="sub_user_list" id="user_list">
          <query/>
        </search>
        <fieldForLabel>label</fieldForLabel>
        <fieldForValue>key_val</fieldForValue>
        <change>
          <condition value="sel">
            <unset token="tok_tgr_bs_login_search"></unset>
            <unset token="tok_sel_user_filt"></unset>
            <unset token="tok_show_tabs"></unset>
          </condition>
          <condition value="all">
            <unset token="tok_result_msg"></unset>
            <unset token="tok_message_color"></unset>
            <unset token="tok_message_state"></unset>
            <unset token="tok_message"></unset>
            <set token="tok_logon_srch_run">true</set>
            <set token="tok_tgr_bs_login_search">True</set>
            <set token="tok_sel_user_filt">$tok_user_filter$</set>
            <set token="tok_pre_filt_flds">cn,sAMAccountName,userPrincipalName</set>
          </condition>
          <condition>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_result_msg"></unset>
            <unset token="tok_message_color"></unset>
            <unset token="tok_message_state"></unset>
            <unset token="tok_message"></unset>
            <set token="tok_logon_srch_run">true</set>
            <set token="tok_tgr_bs_login_search">True</set>
            <set token="tok_sel_user_filt">$value$</set>
            <set token="tok_pre_filt_flds">_key</set>
            <set token="atok_sel_user_filt">search _key="$value$"</set>
          </condition>
        </change>
      </input>
      <html depends="$tok_message_state$" id="inp_msg">
        <p style="font-size:8;" id="inp_msg_p">
          <font color="$tok_message_color$">
            <i>
              <b>$tok_message_state$ </b> $tok_message$</i> 
          </font>
        </p>
      </html>
    </panel>
  </row>
  <row id="rw_show_filt_btn">
    <panel>
      <html depends="$tok_hide_filters_btn$">
      	<center>
          <a href="" class="btn btn-primary btn-mini" data-token-json="{&quot;show_filters&quot;:&quot;undefined&quot;,&quot;tok_hide_filters_btn&quot;:&quot;undefined&quot;,&quot;tok_show_filters_btn&quot;:&quot;active&quot;}" style="padding-left: 15px !important;padding-right: 15px !important;">Hide Filters</a>
        </center>
      </html>
      <html depends="$tok_show_filters_btn$">
      	<center>
          <a href="" class="btn btn-primary btn-mini" data-token-json="{&quot;show_filters&quot;:&quot;active&quot;,&quot;tok_hide_filters_btn&quot;:&quot;active&quot;,&quot;tok_show_filters_btn&quot;:&quot;undefined&quot;}" style="padding-left: 15px !important;padding-right: 15px !important;">Show Filters</a>
        </center>
      </html>
    </panel>
  </row>
  <row id="tabs_row" depends="$tok_show_tabs$">
    <panel>
      <html>
        <ul id="tabs" class="nav nav-tabs">
          <li>
            <img src="/static/app/ms_windows_ad_objects/ms_windows_ad_objects_icon.png" id="img_vj_mgmt_icon" style="height: 30px !important;width: 30px !important;padding-right:5px !important;"/>
          </li>
          <li class="$tok_tab_1$">
            <a href="#tab_stat_ratio" class="toggle-tab" data-token-json="{&quot;tok_tab_1&quot;:&quot;active&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;}" style="padding-left: 15px !important;padding-right: 15px !important;">Status - Ratio</a>
          </li>               
			<li class="$tok_tab_2$">
            <a href="#tab_search_details" class="toggle-tab" data-token-json="{&quot;tok_tab_2&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;}" style="padding-left: 15px !important;padding-right: 15px !important;">Search Details</a>
          </li> 
		 </ul>
      </html>
    </panel>
  </row>
  <row depends="$tok_logon_srch_run$">
    <panel>
      <html>
          <center>
          <h2>
            <img class="run_spin run_spin_dom_chk hidden" style="height:30px;width:30px;" src="/static/app/ms_windows_ad_objects/loader_green_on_grey.gif"/> Search Running</h2>
        </center>
        </html>
    </panel>
  </row>
  <row depends="$tok_result_msg$" id="rw_result_msg">
    <panel>
      <html depends="$tok_logon_srch_empty$">
        <center>
          <h2>
            <i class="icon-warning" style="height:20px;width:20px;color:red;"> Warning: No Logon Events were found with matching users from the selected inputs.</i>
          </h2>
        <h4>Either adjust the <i>Selected Time Period</i> or the selected inputs.</h4>
        </center>
        <center>
			<table border="1">
				<tr>
					<td style="width:90%;">
						<ul>
							<li>Initial Base Search:
								<ul>
									<li>
                        <pre>$tok_srch_bs_logon_dom_filt$</pre>
                      </li>
								</ul>
							</li>
						</ul>
					</td>
					<td style="width:10%;text-align:center;">
						<a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon_dom_filt|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
							<i class="icon-search"> Open Search</i>
						</a>
					</td>
				</tr>
				<tr>
					<td style="width:90%;">
						<ul>
							<li>Full Base Search:
								<ul>
									<li>
                        <pre>$tok_srch_bs_logon_full$</pre>
                      </li>
								</ul>
							</li>
						</ul>
					</td>
					<td style="width:10%;text-align:center;">
						  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon_full|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
							<i class="icon-search"> Open Search</i>
						  </a>
					</td>
				</tr>
			</table>
		</center>
      </html>
    </panel>
  </row>
  <row depends="$tok_show_tabs$,$tok_tab_1$" id="rw_results">
    <panel id="rw_results_filters">
      <title>Filter Login Success Ratio Results:</title>
      <input type="text" token="tok_min_attempts" searchWhenChanged="true">
        <label>Minimum Logon Attempts</label>
        <default>0</default>
        <initialValue>0</initialValue>
      </input>
      <input type="text" token="tok_min_failure_srch" searchWhenChanged="true">
        <label>Minimum Failure Percent</label>
        <default>0</default>
        <initialValue>0</initialValue>
        <change>
          <condition value="0">
            <set token="tok_min_failure">Fail_Percent&gt;-1</set>
          </condition>
          <condition>
            <set token="tok_min_failure">Fail_Percent&gt;$value$</set>
          </condition>
        </change>
      </input>
      <input type="text" token="tok_min_hosts" searchWhenChanged="true">
        <label>Minimum Hosts</label>
        <default>0</default>
        <initialValue>0</initialValue>
      </input>
    </panel>
    <panel id="rw_single_counts">
      <single>
        <title>Total Users</title>
        <search base="bs_login_search">
          <query>stats dc(Logon_User) AS Total_Users</query>
        </search>
      </single>
      <single>
        <title>Total Attempts</title>
        <search base="bs_login_search">
          <query>search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$          
| stats sum(Total_Attempts) AS Total_Attempts</query>
        </search>
      </single>
      <single>
        <title>Total Failed Attempts</title>
        <search base="bs_login_search">
          <query>search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$          
| stats sum(fail_count) AS Total_Failed_Attempts</query>
        </search>
      </single>
      <single>
        <title>Total Success Attempts</title>
        <search base="bs_login_search">
          <query>search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$          
| stats sum(success_count) AS Total_Success_Attempts</query>
        </search>
      </single>
      <single>
        <title>Average Failure Ratio</title>
        <search base="bs_login_search">
          <query>search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$          
| stats avg(Fail_Percent) AS Average_Failure_Ratio</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[30,50,70]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
      </single>
      <single>
        <title>Average Success Ratio</title>
        <search base="bs_login_search">
          <query>search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$          
| stats avg(Success_Percent) As Average_Success_Ratio</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0xd93f3c","0xf58f39","0xf7bc38","0x65a637"]</option>
        <option name="rangeValues">[30,50,70]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel id="rw_result_details">
      <title>Logon - Sucess - Fail - Ratio Result Details:</title>
      <table>
        <search base="bs_login_search">
          <query>| search Total_Attempts&gt;$tok_min_attempts$ $tok_min_failure$ Session_Host_Count&gt;$tok_min_hosts$
| eval Fail_Percent=Fail_Percent."% (".tostring(fail_count,"commas").")"
| eval Success_Percent=Success_Percent."% (".tostring(success_count,"commas").")"
| eval Total_Attempts=tostring(Total_Attempts,"commas")
| table Domain,Logon_User,Domain_Account,Session_Host_Count,Total_Attempts,Fail_Percent,Success_Percent,First_Attempt,Last_Attempt
| lookup AD_Obj_Domain domain AS Domain OUTPUT user_lookup
| eval user_lookup=if(isnull(user_lookup),"#All#",user_lookup)
| eval dd_filt=Domain_Account."|".Domain."|".Logon_User."|".user_lookup</query>
        </search>
        <option name="count">15</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Domain_Account">
          <colorPalette type="map">{"True":#65A637,"False":#D93F3C}</colorPalette>
        </format>
        <format type="color" field="Success_Percent">
          <colorPalette type="list">[#DC4E41,#EC9960,#53A051]</colorPalette>
          <scale type="threshold">0,70</scale>
        </format>
        <format type="color" field="Session_Host_Count">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Total_Attempts">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <fields>["Domain","Logon_User","Domain_Account","Session_Host_Count","Total_Attempts","Fail_Percent","Success_Percent","First_Attempt","Last_Attempt"]</fields>
        <drilldown target="blank">
          <eval token="dd_dom_status">if("$row.Domain_Account$"=="Domain_Account","True","False")</eval>
          <eval token="dd_user_filter_inp">if("$row.Domain_Account$"=="Domain_Account","tok_user_filter_bs","tok_user_filter_non_dom_bs=".$row.Logon_User$)</eval>
          <eval token="dd_domain">if("$row.Domain_Account$"=="Domain_Account",$row.Domain$,"sel")</eval>form.tok_domain<eval token="dd_sel_user">if("$row.Domain_Account$"=="Domain_Account","all","sel")</eval>
          <set token="tok_user_srch">user="$row.Logon_User$"</set>
          <link>
            <![CDATA[
              /app/ms_windows_ad_objects/ms_ad_obj_admin_login_user?tok_user_dd=$row.dd_filt$&form.time_field.earliest=$earliest$&form.time_field.latest=$latest$
            ]]>
          </link>
        </drilldown>
      </table>
      <html>
        <h4>
          <i>Click on a User to review more details on the users logon activities</i>
        </h4>
      </html>
    </panel>
  </row>
  <row id="tab_search_details" depends="$tok_show_tabs$,$tok_tab_2$">
    <panel>
      <title></title>
      <html>
        <center>
        <h2>
            <b>Base Search Details:</b>
          </h2>
        <table border="1" style="width:98%;">
          <tr>
            <th style="width:10%;">Search Content:</th>
            <th style="width:50%;">Search:</th>
            <th style="width:40%;">Description:</th>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>1. <i>Base Data</i>
                </h4>
                <i>Logon Events</i>
              </td>
            <td>
                <pre>$tok_srch_bs_logon$</pre>
              </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This is the base search that looks for failed or successful <b>User</b> logons.</li>
                <li>
                  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
                    <i class="icon-search"> Open Search</i>
                  </a>
                </li>
              </ul>
            </td>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>2. <i>Base Filter</i>
                </h4>
                <i>Domain Status</i>
              </td>
            <td>
                <pre>$tok_domain_acct$</pre>
              </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This filter determines whether the user account that failed to logon was found in the AD Domain.
                  <ul>
                      <b>Domain Status Selection to Search Values:</b>
                    <li>
                        <b>Domain Account:</b> <code>NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064</code>
                      </li>
                    <li>
                        <b>Non-Domain Account:</b> <code>(Sub_Status=0xC0000064 OR Error_Code=0xC0000064)</code>
                      </li>
                    <li>
                        <b>All:</b> <i>When selected the Domain Status filter will be blank.</i>
                      </li>
                  </ul>
                </li>
                <li>
                  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon_dom|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
                    <i class="icon-search"> Open Search</i>
                  </a>
                </li>
              </ul>
            </td>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>3. <i>Base Filter</i>
                </h4>
                <i>Raw Text</i>
              </td>
            <td>
                <pre>($tok_srch_filt_raw$)</pre>
              </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This filter is raw text that is added to the <b>Base Logon Search</b> for quickly filtering out logon events for matching, or selected user accounts.</li>
                <li>Raw Text searching provides greater speed and performance vs trying to look for exact field values <i>(ie. <code>"hax0r"</code> <b>vs</b> <code>user="hax0r"</code>
                    </i>.</li>
                <li>When searching for the <b>Domain Account</b> logon activity, the <i>Raw Text Filter</i> will inlcude the matching or selected User's <b>CN, sAMAccountName, and userPrincipleName</b> to ensure all logon activity data is captured for the User.</li>
                <li>
                  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_filt_raw|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
                    <i class="icon-search"> Open Search</i>
                  </a>
                </li>
              </ul>
            </td>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>4. <i>Final Filter</i>
                </h4>
                <i>User Link</i>
              </td>
            <td>
                <pre>$tok_filt_link$</pre>
              </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This filter is used later in the search to specifically match the <b>user</b> field in the data with input selections.</li>
                <li>This seems to be redundant, but it speeds up the search process by using the <b>Raw Text Filter</b> first, and then using this <b>Link Filter</b> later on to match the user.</li>   
                <li>It is also necessary to ensure the returned values are correctly mapped to the input selections.</li>
              </ul>
            </td>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>5. <i>Full Base</i>
                </h4>
                <i>Resulting Search</i>
              </td>
            <td>
                <pre>$tok_srch_bs_logon_full$
            </pre>
              </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This is the full <b>base</b> search that combines the above search components, along with field formatting, to return the data used by the <i>Post Processing Searches</i> to populate each of the resulting panels in this dashboard.</li>
                <li>
                  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon_full|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
                    <i class="icon-search"> Open Search</i>
                  </a>
                </li>
              </ul>
            </td>
          </tr>
          <tr>
            <td style="text-align:center;">
                <h4>5. <i>Status Ratio</i>
                </h4>
                <i>Resulting Search</i>
              </td>
            <td>
                <pre>$tok_srch_bs_logon_full$ $tok_srch_logon_ratio_full$</pre>
            </td>
            <td style="vertical-align:top;">
              <ul style="padding-left:10px;">
                <li>This is the full <b>Status Ratio</b> search that combines the above search components, along with the calculations for the Logon Status Ratio.</li>
                <li>
                  <a href="/app/ms_windows_ad_objects/search?q=$tok_srch_bs_logon_full|u$%20$tok_srch_logon_ratio_full|u$&amp;earliest=$time_field.earliest$&amp;latest=$time_field.latest$" class="btn small" target="_blank">
                    <i class="icon-search"> Open Search</i>
                  </a>
                </li>
              </ul>
            </td>
          </tr>
        </table>
        </center>
      </html>
    </panel>
  </row>
  <row depends="$hiddenstyle$">
    <panel>
      <html>
          <style>
#rw_results {border: 4px solid #f99d1c;padding: 2px;margin: 2px;}
#rw_show_filt_btn {padding: 2px;margin: 2px;}
#res_filt_msg {padding:0 !important;margin:0 !important;}
#rw_result_msg {border: 4px solid red;padding: 2px;margin: 2px;}
#rw_initial_panel-fieldset {height:130px !important;padding: 0px 12px 0px 12px !important;}
#rw_initial_panel .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:180px !important;height:180px !important;width: 100% !important;border: 4px solid #e20082;}
#rw_results_filters {padding: 0px;width: 99.5% !important;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;text-align: center;}
#rw_results_filters dashboard-panel h2.panel-title {font-weight:bold !important;}
#rw_results_filters .dashboard-panel {min-height: 100px !important;height: 100px !important;width: 100% !important;border: 3px solid #e20082;}
#rw_results_filters-fieldset {padding: 0px 12px 0px 12px !important;}
#rw_single_counts {padding-right: 5px !important;width: 99.5% !important;margin-right: 5px !important;padding-bottom: 0px !important;text-align: center !important;}
#rw_single_counts .dashboard-panel {min-height: 80px !important;max-height: 100px !important;width: 99% !important;margin: 0px !important;left: 1%;padding-bottom: 0px !important;}
#rw_single_counts .dashboard-row .dashboard-panel .panel-head h3 {line-height: 1;margin: 0;padding: 4px 5px 1px 2px;text-rendering: initial;word-wrap: break-word;font-weight: bold;font-size: 14px;}
#rw_single_counts .dashboard-panel .panel-element-row div.single {border: 2px solid #f99d1c;width: 16% !important;padding: 1px !important;margin: 1px !important;left: .5%;}
#rw_single_counts .dashboard-row .dashboard-panel .panel-title.empty + .fieldset.empty + .panel-element-row {border-top: none;text-align: center !important;width: 100% !important;}
#rw_result_details {padding: 0px;width: 99.5% !important;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;}
#rw_result_details .dashboard-panel h2.panel-title {font-weight:bold !important;}
#rw_result_details .dashboard-panel {width: 99% !important;border: 2px solid #f99d1c;left: .5%;}
#tab_search_details {padding: 2px;width: 99% !important;margin-bottom: 0px !important;margin-left: 10px !important;padding-bottom: 0px !important;}
#tab_search_details .dashboard-panel h2.panel-title {font-weight:bold !important;}
#tab_search_details .dashboard-panel {width: 100% !important;border: 4px solid #f99d1c;}
#rw_show_filt_btn {padding: 2px;width: 99% !important;margin-bottom: 0px !important;margin-left: 10px !important;padding-bottom: 0px !important;}
#rw_show_filt_btn .dashboard-panel {min-height: 45px !important;height: 45px !important;width: 100% !important;}
#hide_filt_btn {padding: 2px;width: 99% !important;margin-bottom: 0px !important;margin-left: 10px !important;padding-bottom: 0px !important;min-height: 45px !important;height: 45px !important;}
#hide_filt_btn a {min-height: 25px !important;height: 25px !important;}</style>
      </html>
    </panel>
  </row>
</form>