@sourcetype = "medigate:alerts:json"
| rename(alert.id, as="Alert ID")
| rename(affected_device.site_name, as="Site")
| rename(alert.category, as="Alert Category")
| rename(affected_device.manufacturer, as="Device Manufacturer")
| rename(affected_device.os, as="Device OS")
| rename(alert.type_name, as="Alert Type")
| rename(alert.description, as="Alert Description")
| rename(alert.device_status, as="Alert Status")
| table([@timestamp, "Alert ID" , "Site", "Alert Category", "Device Manufacturer", "Device OS", "Alert Type", "Alert Description", "Alert Status"])

@sourcetype = "medigate:alerts:json"
| groupBy("alert.device_status")

@sourcetype = "medigate:alerts:json"
| groupBy("alert.category")

@sourcetype = "medigate:alerts:json"
| timeChart(alert.type_name)

@sourcetype = "medigate:alerts:json"
| groupBy("affected_device.device_category")

@sourcetype = "medigate:alerts:json" alert.device_status=Unresolved
| count(field=alert.id, distinct=true)

@sourcetype = "medigate:alerts:json"
| groupBy("affected_device.device_subcategory")

@sourcetype = "medigate:devices:json"
| "Connection Type":=concatarray(connection_type_list, separator=", ")
| "Device Family":=rename(device_type_family)
| first_seen_epoch_time:=parseTimestamp(field=first_seen)
| "First Seen":=formatTime("%Y/%m/%d %H:%M:%S", field=first_seen_epoch_time)
| Hostname:=concatarray(dhcp_hostnames, separator=", ")
| IP:=concatarray(ip_list, separator=", ")
| "IP Assignment":=concatarray(ip_assignment_list, separator=", ")
| Online:=rename(is_online)
| last_seen_epoch_time:=parsetimestamp(field=last_seen)
| "Last Seen":=formatTime("%Y/%m/%d %H:%M:%S",field=last_seen_epoch_time)
| MAC:=concatarray(mac_list, separator=", ")
| Model:=rename(model)
| Manufacturer:=rename(manufacturer)
| "Risk Level":=rename(risk_score)
| groupBy("uid", function=selectLast(["IP", "IP Assignment", "MAC", "Hostname", "Device Family", "Manufacturer", "Model", "Connection Type", "Risk Level", "First Seen", "Last Seen", "Online"]))
| table([ "IP", "IP Assignment", "MAC", "Hostname", "Manufacturer", "Model", "Device Family", "Connection Type", "Risk Level", "First Seen", "Last Seen", "Online"])
| sort("Last Seen", order=desc)

@sourcetype=medigate:devices:json and risk_score=*
| groupBy("risk_score")

@sourcetype = "medigate:devices:json"
| groupBy("uid", function=selectLast(["device_type_family"]))
| device_type_family:=replace(regex=null, with=Unknown, field=device_type_family)
| groupBy("device_type_family", function=count())

@sourcetype = "medigate:devices:json"
| groupBy("uid", function=selectLast(["manufacturer"]))
| manufacturer:=replace(regex=null, with=Unknown, field=manufacturer)
| groupBy("manufacturer", function=count())

@sourcetype = "medigate:devices:json" model!=null
| groupBy("uid", function=selectLast(["model"]))
| groupBy("model", function=count())

@sourcetype = "medigate:devices:json"
| count(field=asset_id, distinct=true)