#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby(victim_primary.name)
| sort((_count))

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby("mitre_tactics_string")
| sort((_count))

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby(victim_primary.ipaddr)
| sort((_count))

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| case { offender_primary.external = "true" | _ip := offender_primary.ipaddr} | worldmap(ip=_ip)

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby(offender_primary.ipaddr)
| sort((_count))

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby(offender_primary.name)
| sort((_count))

#type="extrahop-rx360-detection" AND "site"=?{site_name=*}
| groupby(categories_array[0])
| sort((_count))

format = "ExFlow" |!undefined
| count(name,distinct=true)

format = "ExFlow" | !undefined | !169.254 | groupby(field=receiverAddr, function=count()) |  sort(field=_count, type=number, limit=10, order=desc)

ExFlow OS | format("[PCAP Download](%s)", field=pcap, as=PCAP)| format("%s", field=pcap, as="pcapLink")|table([@timestamp,OS, name, mac ,senderAddr, senderPort,receiverAddr, receiverPort, bytes, pkts, l7proto, proto, age,PCAP])

//| receiverAddr = ?ReceiverIP AND senderAddr = ?SenderIP
| worldMap(ip=receiverAddr)

format = "ExFlow" | New Device | count(receiverAddr, distinct=True)

worldMap(ip=senderAddr)

type = EH-ThreatHunt
| groupby(name) | sort(field=_count, type=number, limit=10, order=desc)

format = "ExFlow" | !undefined | !169.254 | groupby(field=l7proto, function=count()) |  sort(field=_count, type=number, limit=10, order=desc)