actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | Actor := rename(actors)  | timechart(series=Actor, limit=50, function=count()) | json:prettyPrint()

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | table([last_updated, malicious_confidence, actors, type, indicator], sortby=last_updated, limit=10000) | "Last Updated" := rename(last_updated) | "Malicious Confidence" := rename(malicious_confidence) | "Actor" := rename(actors) | "Indicator Type" := rename(type) | "Indicator" := rename(indicator)

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | "Indicator Type" := rename(type)  | timechart(series="Indicator Type", limit=50, function=count())

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | "Malicious Confidence" := rename(malicious_confidence)  | timechart(series="Malicious Confidence" , limit=50, function=count())

malware_families[0]=* | split(malware_families) | malware_families=?malware_families type=?indicator_type malicious_confidence=?malicious_confidence  | "Malware Family" := rename(malware_families)  | timechart(series="Malware Family", limit=50, function=count())

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | table([last_updated, malicious_confidence, actors, type, indicator], sortby=last_updated, limit=10000) | "Last Updated" := rename(last_updated) | "Malicious Confidence" := rename(malicious_confidence) | "Actor" := rename(actors) | "Indicator Type" := rename(type) | "Indicator" := rename(indicator)

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | "Indicator Type" := rename(type)  | timechart(series="Indicator Type", limit=50, function=count())

actors[0]=* | split(actors) | actors=?Actor type=?indicator_type malicious_confidence=?malicious_confidence  | "Malicious Confidence" := rename(malicious_confidence)  | timechart(series="Malicious Confidence" , limit=50, function=count())

deleted=false "malicious_confidence"=low | count()

deleted=true | count()

timechart(series=type, limit=30, function=count())

count()

actors[0]=* | Actor := actors[0]  | top(field=Actor) | rename(field=_count, as=Count)

top("malware_families[0]")| split(malware_families)  | Count := rename(_count) | "Malware Family" := rename(malware_families[0]) | table(["Malware Family", "Count"])

"published_date" !=last_updated | count()

deleted=false "malicious_confidence"=high | count()

deleted=false "malicious_confidence"=unverified | count()

deleted=false "malicious_confidence"=medium | count()