#event.module = "nginx" | #event.dataset = "nginx.error"
| log.level = "error"
| host.name = ?{server=*} //server parameter
| timeChart(host.name, limit=5) //It'll display top 5 servers causing error over the time

#event.module = "nginx" | #event.dataset = "nginx.error"
| log.level = "error"
| host.name = ?{server=*} //server parameter
| timeChart(client.ip, limit=5) //It'll display top 5 clients causing error over the time

#event.module = "nginx" | #event.dataset = "nginx.error"
| log.level = "error"
| host.name = ?{server=*} //server parameter
| top(field=message, limit=10, as=Count)

#event.module = "nginx" | #event.dataset = "nginx.error"
| host.name = ?{server=*} //server parameter
| timechart(log.level) //It'll display log levels over time

#logtype = "apache-access-log"
| status_code = 4*
| timeChart(client_ip, limit=5) // Displays the top 5 clients with 4xx status codes over time

#logtype = "apache-access-log"
| status_code >= 400
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| case {
  status_code = 5* | error_type := "Server error";
  status_code = 4* | error_type := "Client error";
}
| timechart(error_type) // Displays the error_type assigned over time

#logtype = "apache-access-log"
| status_code = 5*
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| timeChart(url, limit=5) // Displays the top 5 urls with maximum count of 5xx status codes over the time

#logtype = "apache-access-log"
| status_code = 4*
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| timeChart(url, limit=5) // Displays the top 5 urls with maximum count of 4xx status codes over the time

#logtype = "apache-access-log"
| status_code = 4*
| default(field=server_name, value="unknown", replaceEmpty=true)
| groupby([server_name, status_code]) // Displays count of the 4xx status codes for each server

#logtype = "apache-access-log"
| status_code = 5*
| default(field=server_name, value="unknown", replaceEmpty=true)
| groupby([server_name, status_code]) // Displays count of the 5xx status codes for each server

#logtype = "apache-access-log"
| status_code >= 400
| case {
    status_code = 4* | error_type := "Client error";
    status_code = 5* | error_type := "Server error";
}
| groupBy(error_type) // Displays client and server errors

#logtype = "apache-access-log"
| client_ip = ?{client_ip=*} // Client IP parameter
| status_code = 4*
| match(file="apache/http-server/status_code.csv", column="status", field="status_code", include=[status_description])
| groupBy([client_ip, status_code , status_description], function=count(as="count"))
| sort(count) // Displays the table of client_ip, status_code, status_description(from the lookup file) with count

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| worldMap(ip=client_ip) // location of malicious client IP's

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict="true", confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| rename(field="ioc.malicious_confidence", as="iocmc")
| timechart(iocmc) // malicious confidence over time

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^ThreatType\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(?<category>^[^\/]+)\/(?<value>.+)$")
| sankey(source="category",target="value") // threat relationships

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^Actor\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^KillChain\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| "ioc.malicious_confidence" match  {
    unverified => icon := "\u2139  " ;
    low => icon := "\u2B07  " ;
    medium => icon := "\u26A0  " ;
    high => icon := "\u2757  " ;
    * => icon := "   " ;
} // icons to display for each malicious confidence
| concat(["icon", "ioc.malicious_confidence"], as="ioc.malicious_confidence")
| now := now()
| ioc_age := now - ioc.last_updated
| formatDuration(ioc_age, precision=2, as="ioc.age")
| groupBy(["ip_addr_IOC", "#repo", "ioc.type", "ioc.indicator", "ioc.malicious_confidence", "ioc.published_date", "ioc.last_updated", "ioc.age", "ioc.labels"]) // // all information regarding malicious client IP's
| formatTime(field="ioc.published_date", as="ioc.published_date", format="%Y-%m-%d %H:%M:%S")
| formatTime(field="ioc.last_updated", as="ioc.last_updated", format="%Y-%m-%d %H:%M:%S")

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^Malware\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| worldMap(ip=client_ip) // location of malicious client IP's

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^ThreatType\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(?<category>^[^\/]+)\/(?<value>.+)$")
| sankey(source="category",target="value") // threat relationships

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^Actor\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^KillChain\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| "ioc.malicious_confidence" match  {
    unverified => icon := "\u2139  " ;
    low => icon := "\u2B07  " ;
    medium => icon := "\u26A0  " ;
    high => icon := "\u2757  " ;
    * => icon := "   " ;
} // icons to display for each malicious confidence
| concat(["icon", "ioc.malicious_confidence"], as="ioc.malicious_confidence")
| now := now()
| ioc_age := now - ioc.last_updated
| formatDuration(ioc_age, precision=2, as="ioc.age")
| groupBy(["ip_addr_IOC", "#repo", "ioc.type", "ioc.indicator", "ioc.malicious_confidence", "ioc.published_date", "ioc.last_updated", "ioc.age", "ioc.labels"]) // // all information regarding malicious client IP's
| formatTime(field="ioc.published_date", as="ioc.published_date", format="%Y-%m-%d %H:%M:%S")
| formatTime(field="ioc.last_updated", as="ioc.last_updated", format="%Y-%m-%d %H:%M:%S")

#logtype = "apache-access-log" or #logtype = "apache-error-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true, confidenceThreshold=?threshold) // ioc search for client IP with threshold parameter
| split("ioc")
| splitString(field="ioc.labels", by=",", as="ioc.labels")
| split("ioc.labels")
| regex(field="ioc.labels", regex="(^Malware\\/(?<value>.+)$)")
| groupBy(value)

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*}  // Server parameter
| case {
  status_code = 2* | response := "success";
  status_code = 3* | response := "redirects";
  status_code = 4* | response := "client_errors";
  status_code = 5* | response := "server_errors";
}
| timechart(response) // Displays the responses assigned for each group of status codes over the time period

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| timeChart(function=count(client_ip, distinct=true)) // Unique client ip's over time

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| worldMap(ip=client_ip) // Worldmap of client locations

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name = *} // Server parameter
| timeChart(function=sum(response_size))

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| regex("\\.(?<media_type>[A-Za-z]+)", field=url)
| groupBy(["media_type"], function=[sum(response_size)])

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| timeChart(server_name, unit="1/s")

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| regex("\\.(?<media_type>[A-Za-z]+)", field=url)
| timeChart(media_type, function=[sum(response_size)]) // media types served over time

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| response_size := sum(response_size)
| eval(response_size = response_size / (1024*1024*1000)) // converting bytes to GB

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| groupBy(server_name, function=[])

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*}
| count("client_ip", distinct=True)

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| top(user_agent, as="count")

#logtype = "apache-access-log"
| regex("https?:\\/\\/(?<domain>.+?)(\\/|\\?|$)", field=referer)
| ioc:lookup(["domain"], type="domain", strict=true)
| timechart()

#logtype = "apache-access-log"
| status_code = 2*
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| top(url, as="count")

#event.module = "nginx" | #event.dataset = "nginx.access"
| host.name = ?{server_name=*} // Server parameter
| worldMap(ip=client.ip) // Worldmap of client locations

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| regex("https?:\\/\\/(?<domain>.+?)(\\/|\\?|$)", field=referer)
| top(domain)

#logtype = "apache-access-log"
| default(field=server_name, value="unknown", replaceEmpty=true)
| server_name = ?{server_name=*} // Server parameter
| regex("https?:\\/\\/(?<domain>.+?)(\\/|\\?|$)", field=referer)
| timeChart(domain, limit=10) // Referer domains over time

#logtype = "apache-access-log"
| ioc:lookup(["client_ip"], type="ip_address", strict=true)
| timechart()