<form version="1.1" theme="light">
  <label>MITRE ATT&amp;CK Techniques Detection</label>
  <fieldset submitButton="false">
    <input type="time" token="tok_time1" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-3d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`sandfly_search_alarms` 
| eval aaa_tags='data.tags{}' 
| fields aaa_tags header.node_name header.host_id data.name 
| mvexpand aaa_tags 
| search aaa_tags="attack.id.*" 
| rex field=aaa_tags "^attack\.id\.(?&lt;aaa_attack_id&gt;.*)$" 
| stats count by aaa_attack_id
| rename aaa_attack_id as "MITRE ATT&amp;CK Techniques"</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="tok_id">$click.value$</set>
          <set token="form.tok_id">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <input type="dropdown" token="tok_host_id" searchWhenChanged="true">
        <label>Hostname</label>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <fieldForLabel>header.node_name</fieldForLabel>
        <fieldForValue>header.host_id</fieldForValue>
        <search>
          <query>`sandfly_search_alarms` earliest=$tok_time1.earliest$ latest=$tok_time1.latest$ 
| eval aaa_tags='data.tags{}' 
| mvexpand aaa_tags 
| search aaa_tags="attack.id.*" 
| rex field=aaa_tags "^attack\.id\.(?&lt;aaa_attack_id&gt;.*)$" 
| search aaa_attack_id=$tok_id$ 
| dedup header.node_name 
| table header.node_name header.host_id
| sort header.node_name</query>
        </search>
      </input>
      <input type="dropdown" token="tok_id" searchWhenChanged="true">
        <label>MITRE ATT&amp;CK Techniques</label>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <fieldForLabel>attack_info</fieldForLabel>
        <fieldForValue>aaa_attack_id</fieldForValue>
        <search>
          <query>`sandfly_search_alarms` earliest=$tok_time1.earliest$ latest=$tok_time1.latest$
| eval aaa_tags='data.tags{}'
| mvexpand aaa_tags
| search aaa_tags="attack.id.*"
| rex field=aaa_tags "^attack\.id\.(?&lt;aaa_attack_id&gt;.*)$"
| dedup aaa_attack_id
| lookup mitre_techniques.csv external_id AS aaa_attack_id OUTPUT name as attack_name
| eval attack_info=aaa_attack_id + " (" + attack_name + ")"
| table aaa_attack_id attack_name attack_info
| sort aaa_attack_id</query>
        </search>
      </input>
      <table>
        <search>
          <query>`sandfly_search_alarms` header.host_id=$tok_host_id$ 
| eval aaa_tags='data.tags{}' 
| fields aaa_tags header.node_name header.host_id data.name 
| mvexpand aaa_tags 
| search aaa_tags="attack.id.*" 
| rex field=aaa_tags "^attack\.id\.(?&lt;aaa_attack_id&gt;.*)$" 
| search aaa_attack_id=$tok_id$ 
| dedup header.host_id data.name aaa_attack_id 
| lookup mitre_techniques.csv external_id as aaa_attack_id OUTPUT name as attack_name 
| eval aaa_attack_info=aaa_attack_id + " (" + attack_name + ")" 
| lookup sandflies.csv sandfly_name as data.name OUTPUT sandfly_description 
| stats list(aaa_attack_info) by header.node_name data.name sandfly_description header.host_id 
| table header.node_name list(aaa_attack_info) data.name sandfly_description header.host_id
| rename header.node_name as "Hostname" 
| rename data.name as "Sandfly Name" 
| rename sandfly_description as "Sandfly Description" 
| rename list(aaa_attack_info) as "MITRE ATT&amp;CK Techniques" 
| rename header.host_id as host_id</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <fields>["Hostname","MITRE ATT&amp;CK Techniques","Sandfly Name","Sandfly Description"]</fields>
        <drilldown>
          <link target="_blank">/app/sandfly_security/sandfly_security_host_alerts?form.tok_host_id=$row.host_id$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>`sandfly_search_alarms` header.host_id=$tok_host_id$
| eval aaa_tags='data.tags{}'
| fields aaa_tags header.node_name header.host_id data.name
| mvexpand aaa_tags 
| search aaa_tags="attack.id.*" 
| rex field=aaa_tags "^attack\.id\.(?&lt;aaa_attack_id&gt;.*)$" 
| search aaa_attack_id=$tok_id$</query>
          <earliest>$tok_time1.earliest$</earliest>
          <latest>$tok_time1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>