Essential SecOps Query Examples

Retrieve Events from a Persisted Aggregation
Reading events stored in a persisted aggregation from a specific view using the readPersistedAggregation() function
Append Grand Total Row to Failed Login Counts
Summarize failed authentication attempts per user and append an overall total using the appendAggregation() function
Append Overall Failure Rate to Individual Events
Calculating and appending an overall failure rate to each event record using the appendAggregation() function with percentage()
Display Container Actions
Display a pie chart of Docker container actions
Display Container IP Addresses
Display a table of Docker container IP addresses and container names
Display Top 10 Containers by Traffic Sent And Received (MB)
Display the top 10 containers by sent and received traffic in MB
Count Nested Array Elements
Count elements in nested arrays using the objectArray:eval() function with array:length()
Calculate Ingest Queue Compression Ratio Over Time
Analyze the ratio between uncompressed and compressed ingest queue bytes
Transform Array Key-Value Pairs Into Top-Level Fields
Flatten structured array data into individual fields using the objectArray:eval() with concatArray() and array:drop()
Display HTTP Request Methods
Track HTTP method usage over time