`notable`
| stats latest(lastTime) as LastTimeSeen values(rule_name) as "Rule Name" values(comment) as "Historical Analysis" values(user) as User by _time event_id, urgency
| eval LastTimeSeen=strftime(LastTimeSeen,"%+")