@divyabarsode  We go to MC > risk Analysis > ad- hoc score > choose the object> reduce manually.  PFA- Screen shot of it ... View more

Hi @richgalloway, @ITWhisperer  I have similar doubt but little tedious:  Use case:In my org primarily Mission Control events are investigated by SOC as soon as they pop up, if futher investigation is needed the incident is escalated to Enterprise security TEAM who is responsible to perform deeper/detailed investigation and update back in Mission Control.  USE CASE:  The enterprise security manger wants a DASHBOARD which will inform him about :  if the investigation is being performed by his team (ES)> how much average time his team member takes to resolve an incident (for now I'm only focusing on this)> averaged over a month.  jeff is ES resource  & stephen is SOC resource  i want to pick end_time where resource is Stephen and notes is "Escalation to ES" and start_time where resource is jeff and subtract them in order to get claim_time_by_ES.  SO far the query I'm using but not successful yet is:    | mcincidents unwind_to=task | search incident_id="3e864839-xyzab" | eval is_es_team=if(IN(owner, "Jeff","Rama", "Mel"), 1, 0) | eval is_soc_team=if(IN(owner, "Stephen", "Crossman", "Ruby","Cole"), 1,0) | eval end_time_for_soc=if(is_soc_team==1 AND name=="Escalation to ES", end_time, null()) | eval start_time_for_ES=if(is_es_team==1, start_time, null()) | eval total_time_claimed=end_time_for_soc - start_time_for_ES   in the below snapshot of log the columns name are in sequence of:  owner > start_time > end_time > total_time_taken> notes     ... View more

  | ldapsearch domain="default" search="(&(samAccountType=000000000) (|(sAMAccountName=*)))" attrs="sAMAccountName, distinguishedName, userAccountControl, whenCreated, personalTitle, displayName, givenName, sn, mail, telephoneNumber, mobile, manager, department, co, l, st, accountExpires, memberOf" | rex field=memberOf "CN=(?<memberOf_parsed>[^,]+)" | eval memberOf=lower(replace(mvjoin(memberOf_parsed, "|"), " ", "_")) | rex max_match=5 field=distinguishedName "OU=(?<dn_parsed>[^,]+)" | eval category=lower(replace(mvjoin(dn_parsed, "|"), " ", "_")) | eval priority=case(match(category, "domain_admin|disabled|hold|executive") OR match(memberOf, "domain_admins|enterprise_admins|schema_admins|administrators"), "critical", match(category, "contractor|service_account|external"), "high", match(category, "employees|training|user_accounts|users|administration"), "medium", 1==1, "unknown") | eval watchlist=case(match(category,"disabled|hold"), "true", 1==1, "false") | eval startDate=strftime(strptime(whenCreated,"%Y%m%d%H%M"), "%m/%d/%Y %H:%M") | eval endDate=strftime(strptime(accountExpires,"%Y-%m-%dT%H:%M:%S%Z"), "%m/%d/%Y %H:%M") | eval work_city=mvjoin(mvappend(l, st), ", ") | rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone,mobile as phone2, manager AS managedBy, department as bunit, co AS work_country | fillnull value="unknown" category, priority, bunit | table identity,prefix,nick,first,last,suffix,email,phone,phone2,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long | outputcsv xyz.csv   this the search that is being used to generate a csv file, and yes, it's same addon as you mentioned.  I believe you're right that > they're writing to a directory (on the same host as HF) And ingesting it by using a input. conf file.  Because in cloud we cannot monitor directories directly from cloud instance.  Correct me? thanks ... View more

Thank you @gcusello !! ... View more

Thank you!! ... View more

Make sense, thank you!! ... View more