SPL

List Notable events with closing history details

Description

5 0

`notable`
| stats latest(lastTime) as LastTimeSeen values(rule_name) as "Rule Name" values(comment) as "Historical Analysis" values(user) as User by _time event_id, urgency
| eval LastTimeSeen=strftime(LastTimeSeen,"%+")

Comments

0 total

Be the first to comment on this SPL.

You must log in to post a comment.

List Notable events with closing history details

Description

Comments

Leave a comment