Create Table Based on Findings?

[dninccno]

We have AV logs that send the detection and the block separately. I'm trying to create a query where I can take each incident_id (which has a log with a block, and a log with a detection) and have the query verify that both of logs are there.

So it would table like incident_id ifDetectionFound ifBlockFound.

I can't seem to wrap my mind around how to have it search the logs again for a block. Right now I'm just indexing for action=block OR action=Detection, but it still requires me to compare incident_ids (which are quite long random bits of numbers)

[ITWhisperer]

| eval ifDetectionFound=if(action="Detection",action,null())
| eval ifBlockFound=if(action="Block",action,null())
| stats values(ifDetectionFound) as ifDetectionFound values(ifBlockFound) as ifBlockFound by incident_id