<form version="1.1" theme="dark">
  <label>Sandfly Security - Hosts by Tags</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="tok_time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="tok_tag" searchWhenChanged="true">
      <label>Tags</label>
      <choice value="*">All</choice>
      <choice value="&quot;&quot;">NO TAGS</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>aaa_host_tag</fieldForLabel>
      <fieldForValue>aaa_host_tag</fieldForValue>
      <search>
        <query>`sandfly_search_hosts_summary` earliest=$tok_time.earliest$ latest=$tok_time.latest$
| dedup host_summary.host_id 
| eval num_tags=mvcount('host_summary.tags{}') 
| fillnull value=0 num_tags 
| search num_tags&gt;0 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag
| dedup aaa_host_tag
| table aaa_host_tag
| sort aaa_host_tag</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Total Unique Hosts</title>
      <single>
        <search>
          <query>`sandfly_search_hosts_summary` 
| dedup host_summary.host_id 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id 
| stats count</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <title>OS Release Names</title>
      <chart>
        <search>
          <query>`sandfly_search_hosts_summary` 
| dedup "host_summary.host_id" 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id 
| eval os_release_name = 'host_summary.os_info_os_release_pretty_name' 
| stats count by os_release_name</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <title>System Architecture</title>
      <chart>
        <search>
          <query>`sandfly_search_hosts_summary` 
| dedup "host_summary.host_id" 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id 
| eval arch='host_summary.os_info_arch' 
| eval arch=if(arch="", "unknown", arch) 
| stats count by arch</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Active Hosts</title>
      <table>
        <search>
          <query>`sandfly_search_hosts_summary` host_summary.active="true" 
| dedup "host_summary.host_id" 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id 
| table host_summary.os_info_node host_summary.hostname host_summary.last_seen_ip_addr host_summary.os_info_os_release_pretty_name host_summary.tags{} host_summary.jump_hosts{} host_summary.authentication_status host_summary.credentials_id host_summary.results_alert host_summary.results_pass host_summary.results_error host_summary.os_info_uptime_days host_summary.date_last_scan host_summary.host_id 
| rename host_summary.os_info_node as "Hostname" 
| rename host_summary.hostname as "Target Address" 
| rename host_summary.last_seen_ip_addr as "IP Address" 
| rename host_summary.os_info_os_release_pretty_name as "OS" 
| rename host_summary.tags{} as "Tags" 
| rename host_summary.jump_hosts{} as "Jump Hosts" 
| rename host_summary.authentication_status as "Auth Status" 
| rename host_summary.credentials_id as "Credential" 
| rename host_summary.results_alert as "Alerts" 
| rename host_summary.results_pass as "Passing" 
| rename host_summary.results_error as "Errors" 
| rename host_summary.os_info_uptime_days as "Uptime (Days)" 
| rename host_summary.date_last_scan as "Last Scan" 
| rename host_summary.host_id as "host_id"</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="count">5</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <fields>["Hostname","Target Address","IP Address","OS","Tags","Jump Hosts","Auth Status","Credential","Alerts","Passing","Errors","Uptime (Days)","Last Scan"]</fields>
        <drilldown>
          <link target="_blank">/app/sandfly_security/sandfly_security__host_details?form.tok_host_id=$row.host_id$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$inactive_panel_show$">
      <title>Inactive Hosts</title>
      <table>
        <search>
          <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="inactive_panel_show">true</set>
            </condition>
            <condition>
              <unset token="inactive_panel_show"></unset>
            </condition>
          </progress>
          <query>`sandfly_search_hosts_summary` host_summary.active="false" 
| dedup "host_summary.host_id" 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id 
| eval date_last_scan='host_summary.date_last_scan' 
| eval date_last_scan=if(isnull(date_last_scan) OR len(date_last_scan)==0 OR date_last_scan=="null", "N/A", date_last_scan) 
| table host_summary.hostname host_summary.os_info_os_release_pretty_name host_summary.active host_summary.tags{} host_summary.jump_hosts{} host_summary.authentication_status host_summary.credentials_id date_last_scan 
| rename host_summary.hostname as "Target Address" 
| rename host_summary.os_info_os_release_pretty_name as "OS" 
| rename host_summary.active as "Active" 
| rename host_summary.tags{} as "Tags" 
| rename host_summary.jump_hosts{} as "Jump Hosts" 
| rename host_summary.authentication_status as "Auth Status" 
| rename host_summary.credentials_id as "Credential" 
| rename date_last_scan as "Last Scan"</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="count">5</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Raw Event</title>
      <event>
        <search>
          <query>`sandfly_search_hosts_summary` 
| dedup "host_summary.host_id" 
| eval aaa_host_tag='host_summary.tags{}' 
| mvexpand aaa_host_tag 
| search aaa_host_tag="$tok_tag$" 
| dedup host_summary.host_id</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>