<form version="1.1" theme="light">
  <label>MITRE ATT&amp;CK Tactics Sandflies</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="tok_time1" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`sandfly_search_sandflies` 
| dedup sandfly_info.name 
| eval aaa_tags='sandfly_info.tags{}' 
| mvexpand aaa_tags
| search aaa_tags="attack.tactic.*" 
| rex field=aaa_tags "^attack\.tactic\.(?&lt;aaa_attack_tactic&gt;.*)$"
| stats count(sandfly_info.name) as "Sandflies" by aaa_attack_tactic
| sort aaa_attack_tactic
| rename aaa_attack_tactic as "MITRE ATT&amp;CK Tactic"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="tok_tactic">$click.value$</set>
          <set token="form.tok_tactic">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <input type="dropdown" token="tok_tactic" searchWhenChanged="true">
        <label>MITRE ATT&amp;CK Tactics</label>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <fieldForLabel>aaa_attack_tactic</fieldForLabel>
        <fieldForValue>aaa_attack_tactic</fieldForValue>
        <search>
          <query>`sandfly_search_sandflies` earliest=$tok_time1.earliest$ latest=$tok_time1.latest$
| dedup sandfly_info.name 
| eval aaa_tags='sandfly_info.tags{}' 
| mvexpand aaa_tags 
| search aaa_tags="attack.tactic.*" 
| rex field=aaa_tags "^attack\.tactic\.(?&lt;aaa_attack_tactic&gt;.*)$" 
| dedup aaa_attack_tactic
| table aaa_attack_tactic
| sort aaa_attack_tactic</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <search>
          <query>`sandfly_search_sandflies` 
| dedup sandfly_info.name 
| eval aaa_tags='sandfly_info.tags{}' 
| mvexpand aaa_tags
| search aaa_tags="attack.tactic.*" 
| rex field=aaa_tags "^attack\.tactic\.(?&lt;aaa_attack_tactic&gt;.*)$"
| search aaa_attack_tactic=$tok_tactic$
| lookup mitre_tactics.csv shortname as aaa_attack_tactic OUTPUT name as attack_tactic_name
| lookup sandflies.csv sandfly_name as sandfly_info.name OUTPUT sandfly_description
| stats list(aaa_attack_tactic) by sandfly_info.name sandfly_description
| table list(aaa_attack_tactic) sandfly_info.name sandfly_description
| rename sandfly_info.name as "Sandfly Name"
| rename sandfly_description as "Sandfly Description"
| rename list(aaa_attack_tactic) as "MITRE ATT&amp;CK Tactics"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>`sandfly_search_sandflies` 
| dedup sandfly_info.name 
| eval aaa_tags='sandfly_info.tags{}' 
| mvexpand aaa_tags
| search aaa_tags="attack.tactic.*" 
| rex field=aaa_tags "^attack\.tactic\.(?&lt;aaa_attack_tactic&gt;.*)$"
| search aaa_attack_tactic=$tok_tactic$</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>