#source=ttp-attachment-logs | fileExtension := splitString(field=fileType, by="/", index=1) |
table(["date","senderAddress", "recipientAddress","route", "fileName",fileExtension, "fileType"]) | rename(fileType, as="File Mime Type") | rename(fileExtension, as="File Type") | sort(field=date, order=desc)

#source=ttp-attachment-logs | result=malicious | groupby(field=recipientAddress, function=count()) | sort()

#source=ttp-attachment-logs | fileType:= splitString(field=fileType, by="/", index=1) | groupby(fileType, function=count()) | sort()

#source=ttp-attachment-logs | result=malicious | timechart(span=1week, function=count())

#source=ttp-attachment-logs | groupby(field=senderAddress, function=count())

#source=audit-events | table(["eventTime", "user", "auditType", "eventInfo"]) | sort(field=eventTime, order=desc)

#source=dlp-logs | groupby(field=policy, function=count()) | sort()

#source=dlp-logs | groupby(field=senderAddress, function=count()) | sort()

#source=dlp-logs | groupby(field=action, function=count()) | sort()

#source=dlp-logs | timechart(span=1week, function=count())

(#source=siem-delivery-logs or #source=siem-receipt-logs) | timechart(span=1week,series=Dir, function=count())

#source=siem-process-logs| Act=Hld | groupby(field=Hld, function=count()) | sort()

#source=siem-receipt-logs | groupBy(field=RejType, function=count()) | sort()

(#source=siem-delivery-logs or #source=siem-receipt-logs) | Delivered=false | groupby(field=RejType) | sort()

#source=ttp-impersonation-logs | taggedMalicious=true | groupby(field=senderAddress, function=count()) | sort()

#source=ttp-impersonation-logs | /newly_observed_domain/ | count()

#source=ttp-impersonation-logs | /targeted_threat_dictionary/ | count()

#source=ttp-impersonation-logs | taggedMalicious=true | groupby(field=recipientAddress, function=count()) | sort()

#source=ttp-impersonation-logs | /advanced_similar_internal_domain/ | count()

#source=ttp-impersonation-logs | /reply_address_mismatch/ | count()

#source=ttp-impersonation-logs | identifiers | /internal_user_name/ | count()

#source=threat-intel-feed-malware-grid | fileType:= splitString(field=FileMimeType, by="/", index=1) | groupby(fileType, function=count()) | sort()

#source=threat-intel-feed-malware-grid | groupby(field=FileSize, function=count()) | sort()

#source = threat-intel-feed-malware-grid |
table(["Timestamp","FileName", "FileMimeType", "FileSize", "Route", "SHA1", "SHA256", "SendingIP"]) | sort(field=Timestamp, order=desc)

#source = threat-intel-feed-malware-grid | worldMap(ip=SendingIP)

#source=threat-intel-feed-malware-grid | timechart(span=1week, function=count())

#source=threat-intel-feed-malware-grid | groupby(field=FileName, function=count()) | sort()

#source=threat-intel-feed-malware-customer | timeChart(span=1week, function=count())

#source=threat-intel-feed-malware-customer | fileType:= splitString(field=FileMimeType, by="/", index=1) | groupby(fileType, function=count()) | sort()

#source=threat-intel-feed-malware-customer | groupby(field=FileName, function=count()) | sort()

#source=threat-intel-feed-malware-customer | groupby(field=FileSize, function=count()) | sort()

#source = threat-intel-feed-malware-customer |
table(["Timestamp","FileName", "FileMimeType", "FileSize", "Route", "SHA1", "SHA256", "SendingIP"]) | sort(field=Timestamp, order=desc)

#source=ttp-url-logs | timechart(span=1week, series=scanResult, function=count())

#source=ttp-url-logs | scanResult=malicious | groupby(field=url, function=count()) | sort()

#source=ttp-url-logs | scanResult=malicious | groupby(field=category, function=count())

#source=ttp-url-logs |  table(["date", "category","userEmailAddress", "url", "userAwarenessAction", "route", "userOverride", "adminOverride", "scanResult"]) | sort(field=date, order=desc) |