log_source = "audit"
| timeChart(audit.msg.res)

log_source = "audit"
| top(["audit.msg.acct"], limit=5, as=Events)
| rename("audit.msg.acct",as="Users")

log_source = "audit"
| match(file="linux/system-logs/message-dictionary.csv", field=audit_type, column="MACRO NAME", include=[DESCRIPTION])
| groupBy(["audit_type",DESCRIPTION])
| rename("audit_type",as="Event Types")
| sort("Event Types")
| drop(["_count"])

log_source = "audit"
| top(["audit.msg.exe"], as=Count, limit=10)
| rename("audit.msg.exe",as="Command")

log_source = "audit"
| top(["audit_type"])

log_source = "audit"
| timeChart(series=@collect.host, limit=10)

count(@collect.host, distinct=True)

log_source =~ in(values=["system", "auth"])
| count()

log_source = "audit"
| count()

audit_type = "USER_MGMT"
| count()

audit_type = "USER_MGMT"
| rename("audit.msg.exe",as="Usermod Command")
| table(["@timestamp", "@collect.host", "Usermod Command", "audit.msg.res"])

timeChart(series=@collect.host)

log_source =~ in(values=["system", "auth"])
| app = "sshd"
| msg = /user unknown/i OR msg = /invalid user/i
| table(["@timestamp", "@collect.host", "pid", "msg"])

log_source =~ in(values=["system", "auth"])
| app = "sshd"
| /Failed password for (?<user>.*) from (?<ip>.*) port/
| groupBy("ip", limit=10)

log_source =~ in(values=["system", "auth"])
| app = "sshd"
| timeChart(series=@collect.host, limit=10)

log_source =~ in(values=["system", "auth"])
| app = "sshd"
| msg = /Failed password/
| count()

log_source = "auth"
| app = "sudo"
| kvParse(msg)
| "TTY="
| top(["COMMAND"])

log_source = "auth"
| app = "sudo"
| kvParse(msg)
| "TTY="
| select(["@timestamp", "@collect.host", "pid", "TTY", "PWD", "USER", "COMMAND"])

log_source = "auth"
| app = "sudo"
| count()

log_source = "auth"
| app = "sudo"
| msg = /session (?<status>.*) for user (?<become_user>.*) (by (?<user>.*))/
| status = "opened"
| table(["@timestamp", "@collect.host", "user", "become_user", "msg"], limit=100)

log_source = "auth"
| app = "sudo"
| msg = /session (?<status>.*) for user (?<become_user>.*) (by (?<user>.*))/
| status = *
| timeChart("@collect.host")