<form version="1.1">
  <label>SSH Hunter - User Summary</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="tok_time1" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="tok_user" searchWhenChanged="true">
      <label>Username</label>
      <fieldForLabel>ssh_user_details.username</fieldForLabel>
      <fieldForValue>ssh_user_details.username</fieldForValue>
      <search>
        <query>`sandfly_search_sshkeys` event_type=ssh_user_details
| dedup ssh_user_details.username
| sort ssh_user_details.username</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Active Keys</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username
| table ssh_user_details.keys_current</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Unique keys used by this user.</option>
        <option name="unit">Key(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>All-Time Keys</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username
| table ssh_user_details.keys_total</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">All keys ever used by this user.</option>
        <option name="unit">Key(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Active Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username
| table ssh_user_details.hosts_current</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Hosts that have this key.</option>
        <option name="unit">Host(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>All-Time Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username
| table ssh_user_details.hosts_total</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Total hosts that have ever had this key.</option>
        <option name="unit">Host(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Duplicates</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username 
| eval has_duplicates = if(match('ssh_user_details.has_duplicate_keys',"true"), "Yes", "No") 
| table has_duplicates</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Duplicate key entries found.</option>
        <option name="useColors">0</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Key Last Seen</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username
| rename ssh_user_details.last_seen as date_last_seen 
| eval last_seen_epoch = strptime(date_last_seen, "%Y-%m-%dT%H:%M:%S%Z") 
| eval local_last_seen = strftime(last_seen_epoch, "%Y-%m-%dT%H:%M:%S %Z") 
| eval time_diff = ceiling(now() - last_seen_epoch)
| eval temp_duration = tostring(time_diff, "duration") 
| eval key_last_seen=replace(temp_duration,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes") 
| table date_last_seen local_last_seen key_last_seen
| rename date_last_seen as "Date Last Seen (UTC)"
| rename local_last_seen as "Date Last Seen (Local Time)"
| rename key_last_seen as "Key Last Seen"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>User Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username 
| spath output=aaa_hosts path=ssh_user_details.hosts{} 
| fields ssh_key_details.friendly_name aaa_hosts
| mvexpand aaa_hosts
| eval _raw = aaa_hosts
| spath
| spath output=aaa_keys path=key_entries{}
| eval aaa_count = mvcount(aaa_keys)
| table node_name target_address aaa_count os_info_os_release_pretty_name tags{} has_duplicate_keys
| rename node_name as "Hostname"
| rename target_address as "Target Address"
| rename aaa_count as "Key Entries"
| rename os_info_os_release_pretty_name as "OS"
| rename tags{} as "Tags"
| rename has_duplicate_keys as "Duplicate Keys"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Duplicate Keys">
          <colorPalette type="map">{"true":#DC4E41}</colorPalette>
        </format>
        <drilldown>
          <set token="tok_host">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_host$">
      <table>
        <title>Key Entries ($tok_host$)</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$" 
| dedup ssh_user_details.username 
| spath output=aaa_hosts path=ssh_user_details.hosts{} 
| fields ssh_key_details.friendly_name aaa_hosts 
| mvexpand aaa_hosts 
| eval _raw = aaa_hosts 
| spath 
| search node_name="$tok_host$" 
| spath output=aaa_keys path=key_entries{} 
| fields aaa_keys 
| mvexpand aaa_keys 
| eval _raw = aaa_keys 
| spath 
| table friendly_name active is_duplicate key_file comment key_type entry_num first_seen last_seen key_file_created key_file_modified hash.sha512 
| rename friendly_name as "Friendly Name" 
| rename active as "Active" 
| rename is_duplicate as "Duplicate Key" 
| rename key_file as "File Name" 
| rename comment as "Comment" 
| rename key_type as "Key Type" 
| rename entry_num as "Entry" 
| rename first_seen as "First Seen" 
| rename last_seen as "Last Seen" 
| rename key_file_created as "File Created" 
| rename key_file_modified as "File Modified" 
| rename hash.sha512 as "sha512 Hash"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="color" field="Duplicate Key">
          <colorPalette type="map">{"true":#DC4E41}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>Raw Event Details</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_user_details ssh_user_details.username="$tok_user$"
| dedup ssh_user_details.username</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>