<form version="1.1" theme="dark">
  <label>MITRE ATT&amp;CK Tactics and Techniques</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>MITRE ATT&amp;CK Tactics</title>
      <table>
        <search>
          <query>| inputlookup mitre_tactics.csv
| table external_id name shortname description
| sort external_id
| rename external_id as "External ID"
| rename name as "Tactic Name"
| rename shortname as "Short Name"
| rename description as "Description"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="tok_tactic">$row.Short Name$</set>
          <set token="form.tok_tactic">$row.Short Name$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>MITRE ATT&amp;CK Techniques</title>
      <input type="dropdown" token="tok_tactic" searchWhenChanged="true">
        <label>MITRE ATT&amp;CK Tactic</label>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
        <fieldForLabel>name</fieldForLabel>
        <fieldForValue>shortname</fieldForValue>
        <search>
          <query>| inputlookup mitre_tactics.csv
| table name shortname
| sort shortname</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <search>
          <query>| inputlookup mitre_techniques.csv
| eval t_tactics=split(tactics,"|") 
| search t_tactics="$tok_tactic$"
| table external_id name t_tactics description
| sort external_id
| rename external_id as "External ID" 
| rename name as "Technique Name"
| rename t_tactics as "Tactics"
| rename description as "Description"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>