Count Policy Events by Users

Visualize policy-related events per user in a pie chart

This is a query example for the Policty events by Users widget in the Summary Dashboard dashboard of the crowdstrike/siem-connector package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result

logscale

metadata.eventType = UserActivityAuditEvent
| metadata.customerIDString = *
| event.OperationName =~ in(values=["create_policy","update_policy","assign_policy","enable_policy","remove_policy","disable_policy","delete_policy","update_precedence"])
| User:=event.UserId
| groupby(User)
| events:=rename(_count)

Introduction

This widget is used to display the distribution of policy-related events across different users in the system, visualized as a pie chart.

In this widget, the groupBy() function is used to aggregate events by user, and the rename() function is used to rename the count field for better readability.

Example incoming data might look like this:

@timestamp	#error	#humioBackfill	#repo	#type	@error	@error_msg	@error_msg[0]	@id	@ingesttimestamp	@timestamp.nanos	@timezone	event.AgentIdString	event.Attributes.execution_id	event.Attributes.report_metadata.subtype	event.Attributes.scheduled_report_id	event.AuditKeyValues[0].Key	event.AuditKeyValues[0].ValueString	event.AuditKeyValues[1].ValueString	event.AuditKeyValues[2].Key	event.AuditKeyValues[2].ValueString	event.CustomerIdString	event.EventType	event.EventUUID	event.ExternalAPIType	event.Nonce	event.OperationName	event.ServiceName	event.UTCTimestamp	event.UserId	event.UserIp	event.cid	event.eid	event.timestamp	metadata.customerIDString	metadata.eventCreationTime	metadata.eventType	metadata.offset	metadata.version
2026-01-20T08:44:43	true	0	auto-dashboard-queries	siem-connector	true	timestamp was not set to a value after 1971. Setting it to now	timestamp was not set to a value after 1971. Setting it to now	sd6u8WImB06fMtTL7gzFlqYX_2_13_1768898683	2026-01-20T08:44:43	0	Z	12345678123456781234567812345678	234567892345678923456789	host_inventory	234567892345678923456789	scheduled_report_id	123456781234567812345678	123456781234567812345678	report_metadata.subtype	detection_summary	b2c3d4e5f6g7h8i9j0k1	Event_ExternalApiEvent	12345678-1234-5678-1234-123456781234	Event_UserActivityAuditEvent	1	delete_report_execution	scheduled_reports	1710343724	adamsb	192.168.2.143	c3d4e5f6g7h8i9j0k1l2	118	2025-03-13:15:48:44 +0000	a1b2c3d4e5f6g7h8i9j0	1710340124	UserActivityAuditEvent	341.111	1.0

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
metadata.eventType = UserActivityAuditEvent
```
Filters events to include only those where metadata.eventType equals UserActivityAuditEvent.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| metadata.customerIDString = *
```
Ensures metadata.customerIDString exists by matching any value.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| event.OperationName =~ in(values=["create_policy","update_policy","assign_policy","enable_policy","remove_policy","disable_policy","delete_policy","update_precedence"])
```
Filters for specific policy-related operations in the event.OperationName field.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| User:=event.UserId
```
Creates a new field named User containing the value from event.UserId.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 5 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| groupby(User)
```
Groups the results by the User field, automatically creating a count for each user.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3[/Filter/] 4[\Add Field/] 5{{Aggregate}} 6["Expression"] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 6 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| events:=rename(_count)
```
Renames the default _count field to events for better readability in the visualization.
Event Result set.

Summary and Results

The widget is used to track and visualize the distribution of policy-related activities across different users in the system.

This widget is useful to identify users who are most active in policy management and to monitor policy-related activities for security and compliance purposes.

Sample output from the incoming example data:

csv

[{"User":"whitep","events":"1"},
{"User":"wrightj","events":"1"},
{"User":"youngd","events":"1"},
{"User":"thomasb","events":"1"},
{"User":"watsonm","events":"1"}]

The results are displayed in a pie chart, where each slice represents a user and its size corresponds to their number of policy-related events.

Versions of this Page

Examples Library