| tail(1)
| time := formatTime("%Y/%m/%d %H:%M:%S.%L", field=@timestamp, locale=en_US, timezone=Z)
| select(time)

#Vendor="obsidiansecurity" | timeChart(span=1d)

#Vendor="obsidiansecurity"
| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!=""
| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name])
| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic")
| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique")
| rename(field=_count, as="Number Detected")

#Vendor="obsidiansecurity" | timechart(Vendor.service.name)

#Vendor="obsidiansecurity"
| groupBy(Vendor.severity)

#Vendor="obsidiansecurity"
| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!="" event.risk_score=*
| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name, severity_value])
| total_risk := event.risk_score * _count
| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic")
| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique")
| rename(field=total_risk, as="Total Risk")
| drop([event.risk_score, _count])

#Vendor="obsidiansecurity" |
Vendor.service.name=* |
groupBy([Vendor.service.name], function=selectLast([Vendor.eventDatetime]))

#Vendor="obsidiansecurity" | timechart(Vendor.severity)

Vendor.type="POSTURE"
| select(fields=[Vendor.severity,Vendor.summary])

Vendor.type="POSTURE"
| groupBy(Vendor.transition)

Vendor.type="POSTURE"
| groupBy(Vendor.domains[0])

Vendor.type="POSTURE"
| groupBy(Vendor.severity)

Vendor.type="POSTURE"
| groupBy(Vendor.name)

Vendor.type="POSTURE"
| groupBy(Vendor.accepted)

#Vendor="obsidiansecurity"
| Vendor.type="THREAT"
| groupBy(Vendor.service.name)

#Vendor="obsidiansecurity"
| Vendor.type="THREAT"
| groupBy(Vendor.severity)

#Vendor="obsidiansecurity"
| Vendor.type="THREAT"
| table(fields=[Vendor.severity, Vendor.eventDatetime, Vendor.service.name, Vendor.relatedActorEmails[0], Vendor.name, Vendor.workflowProperties.status, event.risk_score ])
| sort(event.risk_score)
| drop(event.risk_score)

#Vendor="obsidiansecurity"
| Vendor.type="THREAT"
| groupBy(Vendor.workflowProperties.status)