#Vendor="google"
|event.action = "dataAccessControlEvent"
|Vendor.trigger_type=?triggertype
|rename(Vendor.trigger_type, as="Trigger Type")
|groupBy(["Trigger Type"])

#Vendor="google"
|event.action = "dataAccessControlEvent"
|user.name=?deviceuser
|rename(user.name, as= "Device User")
|top("Device User", as=count)

#Vendor="google"
|event.action = "dataAccessControlEvent"
|user.name=?deviceuser 
|Vendor.triggered_rules=?triggeredrules
|rename(user.name, as= "Device User")
|rename(Vendor.triggered_rules, as="Triggered Rule")
|sankey(source="Device User", target="Triggered Rule")

#Vendor="google"
|event.action = "dataAccessControlEvent"
| case{
    Vendor.trigger_type="PRINTING"
    | Vendor.destination := "PRINTING";
    *
}
| Vendor.source=?source
| Vendor.destination=?destination
|rename(Vendor.source, as="Source")
|rename(Vendor.destination, as="Destination")
|sankey(source="Source", target="Destination")

#Vendor="google"
|event.action = "dataAccessControlEvent"
|user.name=?deviceuser 
| Vendor.triggered_rules=?triggeredrules 
| Vendor.trigger_type=?triggertype 
| Vendor.result=?result
|rename(user.name, as= "Device User")
|rename(Vendor.triggered_rules, as="Triggered Rule")
|rename(Vendor.trigger_type, as="Trigger Type")
|rename(Vendor.result, as="Outcome")
|table(["@timestamp", "Device User", "Triggered Rule", "Trigger Type", "Outcome"])

#Vendor="google"
|event.action = "dataAccessControlEvent"
|Vendor.triggered_rules=?triggeredrules
|rename(Vendor.triggered_rules, as="Triggered Rule")
|groupBy(["Triggered Rule"])

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT" | event.reason="CHROMEOS_AFFILIATED_LOGIN"
|device.name=?device_name | user.name=?device_user
|rename(device.name, as="Device Name") |rename(user.name, as="Device User")
|select(["@timestamp", "Device Name", "Device User"])

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT" 
|event.reason="CHROMEOS_UNAFFILIATED_LOGIN"
|device.name=?device_name
|rename(device.name, as="Device Name")
|select(["@timestamp", "Device Name"])

#Vendor="google"
|Vendor.client_type="CHROME_OS_DEVICE" event.action="CHROMEOS_PERIPHERAL_ADDED"
|device.name=?device_name | user.name=?device_user
|Vendor.event_detail=/vendor:\s(?<VendorName>.*?),.*product:\s(?<ProductDetail>.*?),/i
|rename(device.name, as="Device Name") |rename(user.name, as="Device User")
|select(["@timestamp", "Device Name", "Device User", "VendorName", "ProductDetail"])

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT" | event.reason="CHROMEOS_GUEST_SESSION_LOGIN"
|device.name=?device_name
|timeChart(function=count())

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT" | event.reason="CHROMEOS_UNAFFILIATED_LOGIN"
|device.name=?device_name
|timeChart(function=count())

#Vendor="google"
|event.action="CHROME_OS_CRD_HOST_STARTED"
|device.model.name=?device_name | user.name=?device_user
|rename(device.model.name, as="Device Name") |rename(user.name, as="Device User")
|select(["@timestamp", "Device Name", "Device User"])

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT"
| event.reason="CHROMEOS_AFFILIATED_LOGIN"
| device.name=?device_name 
| user.name=?device_user
|timeChart(function=count())

#Vendor="google"
|event.action="CHROME_OS_CRD_CLIENT_CONNECTED"
|device.name=?device_name | user.name=?device_user
|rename(device.name, as="Device Name") |rename(user.name, as="Device User")
|select(["@timestamp", "Device Name", "Device User"])

#Vendor="google"
|event.action="CHROME_OS_LOGIN_EVENT" 
|event.reason="CHROMEOS_GUEST_SESSION_LOGIN"
|device.name=?device_name
|rename(device.name, as="Device Name")
|select(["@timestamp", "Device Name"])

#Vendor="google"
|Vendor.client_type = ?client_type
|event.action = ?event
|host.os.type = ?os_platform
|event.reason = ?reason
|rename(device.id, as="Device ID") |rename(user.name, as="Device User") |rename(Vendor.client_type, as="Client Type") |rename(event.action, as="Event") |rename(Vendor.content_name, as="Content Name") |rename(Vendor.browser_version, as="Browser Version") |rename(host.os.type, as="OS Platform") |rename(host.os.version, as="OS Version") |rename(Vendor.reason, as="Reason") |rename(Vendor.reason, as="Result") |rename(Vendor.trigger_type, as="Trigger Type") |rename(Vendor.agents.crowdstrike.agentId, as="CrowdStrike Agent ID") |rename(Vendor.agents.crowdstrike.customerId, as="CrowdStrike Customer ID")

|select([@timestamp, "Device ID", "Device User", "Client Type", "Event", "Content Name", "Browser Version", "OS Platform", "OS Version", "Reason", "Result", "Trigger Type", "CrowdStrike Agent ID", "CrowdStrike Customer ID"])

#Vendor="google"
|event.action = "browserCrashEvent"
| device.id=?device_id | device.model.name=?device_name | user.name=?device_user | Vendor.browser_version=?{browser_version=*} | Vendor.browser_channel=?{browser_channel=*}
|rename(device.id, as="Device ID") |rename(device.model.name, as="Device Name") |rename(user.name, as="Device User") |rename(Vendor.browser_version, as="Browser Version") |rename(Vendor.browser_channel, as="Browser Channel")
|select(["Device Name","Device ID", "Device User", "Profile User", "Browser Version", "Browser Channel"])

#Vendor="google"
|event.reason=?reason
|timeChart(event.reason,limit=10)

#Vendor="google"
|event.action=?event
|timeChart(event.action,limit=10)

#Vendor="google"
|event.action="browserExtensionInstallEvent"
|match(file="chrome_extensions_blocklist.csv", field="extension_id")
|Vendor.extension_id=?extension_id
|Vendor.extension_name=?extension_name
|rename(Vendor.extension_id, as="Extension ID")
|rename(Vendor.extension_name, as="Extension Name")
|rename(device.id, as="Device ID")
|rename(user.name, as="Device User")
|rename(host.os.type, as="OS Platform")
|select(["Extension Name", "Extension ID", "@timestamp", "Device User", "Device ID", "OS Platform"])

#Vendor="google"
|event.action="browserExtensionInstallEvent"
|Vendor.extension_id=?extension_id
|Vendor.extension_name=?extension_name
|groupby([Vendor.extension_id, Vendor.extension_name], function=count(as=Count)) | sort(Count, order=asc)
|rename(Vendor.extension_id, as="Extension ID")
|rename(Vendor.extension_name, as="Extension Name")
|select(["Extension Name", "Extension ID", "Count"])

#Vendor="google"
|event.action="browserExtensionInstallEvent"
|Vendor.extension_id=?extension_id
|Vendor.extension_name=?extension_name
|rename(Vendor.extension_id, as="Extension ID")
|rename(Vendor.extension_name, as="Extension Name")
|rename(device.id, as="Device ID")
|rename(Vendor.profile_user, as="Profile User")
|select(["@timestamp", "Device ID", "Profile User", "Extension Name", "Extension ID"])

#Vendor="google"
|host.os.type=?os_platform
|groupBy(host.os.type)
|rename(host.os.type,as="OS Platform")

#Vendor="google"
|event.action=/^(badNavigationEvent|passwordReuseEvent)$/
|event.reason="SOCIAL_ENGINEERING"
|url.original=?url
|rename(url.original, as="URL")
|top(["URL"],limit=10,rest=others,as="Count")

#Vendor="google"
|device.id=?device_id
|count("device.id", distinct=true, as="Count")

#Vendor="google"
|groupBy("event.reason")

#Vendor="google"
|event.action=/^(badNavigationEvent|passwordReuseEvent|dangerousDownloadEvent)$/
|url.original=?url
|rename(url.domain, as="Hostname")
|top(["Hostname"],limit=10,rest=others,as="Count")

count(Vendor.trigger_type, distinct=true)

count(user.name, distinct=true)

#Vendor="google"
|top(Vendor.result,limit=10,rest=others,as="Count")
|rename(Vendor.result,as="Result")
|select(["Result","Count"])

#Vendor="google"
|top(Vendor.trigger_type, as="Count")
|rename(Vendor.trigger_type,as="Trigger Type")
|select(["Trigger Type","Count"])

#Vendor="google"
|top(user.name, as="Count")
|rename(user.name,as="Device User")

#Vendor="google"
|user.name=?device_user
|device.id=?device_id
|rename(user.name, as="Device User")
|rename(device.id, as="Device ID")
|sankey(source="Device User", target="Device ID")

#Vendor="google"
|device.id=?device_id | device.model.name=?device_name | user.name=?device_user | Vendor.profile_user=?profile_user
|groupBy(["device.id", "device.model.name", "user.name", "Vendor.profile_user"])
|rename(device.id, as="Device ID") |rename(device.model.name, as="Device Name") |rename(user.name, as="Device User") |rename(Vendor.profile_user, as="Profile User")
|select(["Device Name","Device ID", "Device User", "Profile User"])

#Vendor="google"
|event.action=?{event=*}
|top(event.action,limit=10,rest=others,as="Count")
|rename(event.action, as="Event Type")
|select(["Event Type","Count"])

#Vendor="google"
|Vendor.profile_user!=""
|Vendor.profile_user=?profile_user
|top(Vendor.profile_user,limit=10,rest=others,as="Count")
|rename(Vendor.profile_user,as="Profile User")
|select(["Profile User", "Count"])

#Vendor="google"
|host.os.type=?os_platform
|count(host.os.type, distinct=true, as="OS Platform")

#Vendor="google"
|groupBy(Vendor.browser_version)

#Vendor="google"
|host.os.type=?os_platform
|top(host.os.type,limit=10,rest=others,as="Count")
|rename(host.os.type,as="OS Platform")
|select(["OS Platform","Count"])

#Vendor="google"
|event.action=/^(badNavigationEvent|passwordReuseEvent|dangerousDownloadEvent)$/
|event.reason="MALWARE"
|url.original=?url
|rename(url.original, as="URL")
|top(["URL"],limit=10,rest=others,as="Count")

#Vendor="google"
|user.name=?device_user
|top(user.name,limit=10,rest=others,as="Count")
|rename(user.name,as="Device User")
|select(["Device User","Count"])