<form version="1.1">
  <label>SSH Hunter - Key Summary</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="tok_time1" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="tok_sshkey" searchWhenChanged="true">
      <label>SSH Key</label>
      <fieldForLabel>ssh_key_details.friendly_name</fieldForLabel>
      <fieldForValue>ssh_key_details.friendly_name</fieldForValue>
      <search>
        <query>`sandfly_search_sshkeys` event_type=ssh_key_details
| dedup ssh_key_details.friendly_name
| sort ssh_key_details.friendly_name</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Key Value ($tok_sshkey$)</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.friendly_name ssh_key_details.key_type ssh_key_details.key_value
| rename ssh_key_details.friendly_name as "Friendly Name"
| rename ssh_key_details.key_type as "Key Type"
| rename ssh_key_details.key_value as "Pubkey"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/sandfly_security/ssh_hunter__key_details?form.tok_sshkey=$click.value$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <title>Hosts with Alerts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.num_hosts_with_alerts</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="underLabel">Hosts with this key that have alerts.</option>
        <option name="unit">Host(s)</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Security Zones</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name 
| spath output=aaa_zones path=ssh_key_details.key_zones{}
| eval aaa_zones_count = if(isnull(aaa_zones), 0, mvcount(aaa_zones))
| table aaa_zones_count</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Security Zones with this key.</option>
        <option name="unit">Zone(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Active Users</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.num_users_current</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Users who have entries with this key.</option>
        <option name="unit">User(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>All-Time Users</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.num_users_total</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Total users who have ever had this key.</option>
        <option name="unit">User(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Active Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.num_hosts_current</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Hosts that have this key.</option>
        <option name="unit">Host(s)</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>All-Time Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| table ssh_key_details.num_hosts_total</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Total hosts that have ever had this key.</option>
        <option name="unit">Host(s)</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Key Last Seen</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name
| rename ssh_key_details.last_seen as date_last_seen 
| eval last_seen_epoch = strptime(date_last_seen, "%Y-%m-%dT%H:%M:%S%Z") 
| eval local_last_seen = strftime(last_seen_epoch, "%Y-%m-%dT%H:%M:%S %Z") 
| eval time_diff = ceiling(now() - last_seen_epoch)
| eval temp_duration = tostring(time_diff, "duration") 
| eval key_last_seen=replace(temp_duration,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes") 
| table date_last_seen local_last_seen key_last_seen
| rename date_last_seen as "Date Last Seen (UTC)"
| rename local_last_seen as "Date Last Seen (Local Time)"
| rename key_last_seen as "Key Last Seen"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Hosts</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$" 
| dedup ssh_key_details.friendly_name 
| spath output=aaa_hosts path=ssh_key_details.key_hosts{} 
| fields ssh_key_details.friendly_name aaa_hosts 
| mvexpand aaa_hosts 
| spath input=aaa_hosts 
| table has_duplicate_keys target_address node_name os_info_os_release_pretty_name tags{} users_with_key results_alert results_error os_info_arch host_id
| rename has_duplicate_keys as "Has Duplicates" 
| rename target_address as "Target Address" 
| rename node_name as "Hostname" 
| rename os_info_os_release_pretty_name as "OS" 
| rename tags{} as "Tags" 
| rename users_with_key as "Key Users" 
| rename results_alert as "Alerts" 
| rename results_error as "Errors" 
| rename os_info_arch as "Arch"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <fields>["Has Duplicates","Target Address","Hostname","OS","Tags","Key Users","Alerts","Errors","Arch"]</fields>
        <drilldown>
          <link target="_blank">/app/sandfly_security/ssh_hunter__host_summary?form.tok_host_id=$row.host_id$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Users</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$" 
| dedup ssh_key_details.friendly_name 
| spath output=aaa_users path=ssh_key_details.key_users{} 
| fields ssh_key_details.friendly_name aaa_users 
| mvexpand aaa_users 
| spath input=aaa_users 
| table has_duplicate_keys username hosts_with_key 
| rename has_duplicate_keys as "Has Duplicates" 
| rename username as "Username" 
| rename hosts_with_key as "Hosts"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Zones</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$" 
| dedup ssh_key_details.friendly_name 
| spath output=aaa_zones path=ssh_key_details.key_zones{} 
| eval aaa_zones_count = if(isnull(aaa_zones), 0, mvcount(aaa_zones)) 
| search aaa_zones_count &gt; 0 
| fields ssh_key_details.friendly_name aaa_zones 
| mvexpand aaa_zones 
| spath input=aaa_zones 
| eval description=if(isnull(description) OR len(description)==0, "&lt;none&gt;", description) 
| table name description hosts_count key_permitted permitted_keys_count violation_host_count 
| rename name as "Zone" 
| rename description as "Description" 
| rename hosts_count as "Zone Hosts" 
| rename key_permitted as "Key Permitted" 
| rename permitted_keys_count as "Permitted Keys" 
| rename violation_host_count as "Violation Hosts"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>Raw Event Details</title>
        <search>
          <query>`sandfly_search_sshkeys` event_type=ssh_key_details ssh_key_details.friendly_name="$tok_sshkey$"
| dedup ssh_key_details.friendly_name</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>