<form version="1.1">
  <label>Bitwarden Organization Events</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="timeframe">
      <label>Timeframe</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="top_users_by">
      <label>Top Users By</label>
      <default>User Email</default>
      <choice value="actingUserId">User ID</choice>
      <choice value="actingUserEmail">User Email</choice>
      <choice value="actingUserName">User Name</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <map>
        <title>Organization Events</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | iplocation ipAddress | lookup geo_countries longitude as lon, latitude as lat | stats count by Country | geom geo_countries featureIdField=Country</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.maximumColor">0x53a051</option>
        <option name="mapping.map.center">(55.97,-40.69)</option>
        <option name="mapping.map.zoom">3</option>
        <option name="mapping.type">choropleth</option>
        <option name="refresh.display">progressbar</option>
      </map>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Organization Events by Device</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | timechart count by deviceName</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Organization Events by Type</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | timechart count by typeName</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>&gt;</search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Organization Events by Device</title>
      <chart>
        <title>Device</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | stats count by deviceName</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <title>Organization Events by Type</title>
      <chart>
        <title>Type</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | stats count by typeName</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Top Organization Event Users</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]> | stats count by $top_users_by$ | sort - count</query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>
        <option name="charting.axisTitleX.text">Acting User</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>Latest Organization Events</title>
        <search>
          <query>`bitwarden_event_logs_index` sourcetype="bitwarden:events" <![CDATA[(type>=1300 AND type<1800)]]></query>
          <earliest>$timeframe.earliest$</earliest>
          <latest>$timeframe.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>