<form version="1.1" theme="light">
  <label>Sandfly Security - Drift Detection</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="tok_time1" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Total Drift Results</title>
      <single>
        <search>
          <query>`sandfly_search_drift` 
| stats count</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <title>Containerized Drift Results</title>
      <single>
        <search>
          <query>`sandfly_search_drift` containerized=true
| stats count</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <title>Total Hosts with Drift Results</title>
      <single>
        <search>
          <query>`sandfly_search_drift` 
| dedup "header.host_id"
| stats count</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <title>Total Drift Results by Host</title>
      <chart>
        <search>
          <query>`sandfly_search_drift`
| stats count by header.node_name</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Total Drift Results by Sandfly</title>
      <chart>
        <search>
          <query>`sandfly_search_drift`
| stats count by data.name
| sort -count
| head 10</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="charting.axisTitleX.text">Sandfly Name</option>
        <option name="charting.axisTitleY.text">Number of Results</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <title>Total Drift Results over Time by Host</title>
      <chart>
        <search>
          <query>`sandfly_search_drift`
| timechart count by header.node_name</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <input type="dropdown" token="tok_host_id" searchWhenChanged="true">
        <label>Hostname</label>
        <choice value="*">All</choice>
        <fieldForLabel>target_name</fieldForLabel>
        <fieldForValue>target_id</fieldForValue>
        <search>
          <query>`sandfly_search_drift` earliest=$tok_time1.earliest$ latest=$tok_time1.latest$
| search data.name="$tok_sandfly$"
| search containerized="$tok_container$"
| dedup header.host_id
| eval target_id = 'header.host_id'
| eval target_addr = 'header.hostname'
| eval target_name = 'header.node_name' + " (" + 'header.hostname' + ")"
| table target_id target_name
| sort target_name</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <input type="dropdown" token="tok_sandfly" searchWhenChanged="true">
        <label>Sandfly Name</label>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <fieldForLabel>sandfly_name</fieldForLabel>
        <fieldForValue>sandfly_name</fieldForValue>
        <search>
          <query>`sandfly_search_drift` earliest=$tok_time1.earliest$ latest=$tok_time1.latest$
| search header.host_id="$tok_host_id$"
| search containerized="$tok_container$"
| dedup data.name
| eval sandfly_name='data.name'
| table sandfly_name
| sort sandfly_name</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="dropdown" token="tok_container" searchWhenChanged="true">
        <label>Containerized</label>
        <choice value="*">All</choice>
        <choice value="true">True</choice>
        <choice value="false">False</choice>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <table>
        <search>
          <query>`sandfly_search_drift` header.host_id="$tok_host_id$" data.name="$tok_sandfly$" containerized="$tok_container$"
| dedup header.host_id data.key_data
| table _time header.hostname header.ip_addr header.node_name data.name containerized data.key_data data.results.explanation
| rename header.hostname as "Target Address" 
| rename header.ip_addr as "IP Address" 
| rename header.node_name as "Hostname" 
| rename data.name as "Sandfly Name" 
| rename containerized as "Containerized"
| rename data.key_data as "Key Forensic" 
| rename data.results.explanation as "Explanation"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>