<form theme="dark" version="1.1">
  <label>Aggregate DMARC data</label>
  <description>A summary of aggregate DMARC report data</description>
  <search id="base_search">
    <query>
      index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$
      | rename spf_results{}.domain as envelope_domain spf_results{}.result as spf_result spf_results{}.scope as spf_scope dkim_results{}.selector as dkim_selector dkim_results{}.domain as dkim_domain dkim_results{}.result as dkim_result
      | fillnull value=null source_reverse_dns source_base_domain dkim_selector dkim_domain dkim_result source_type source_name
      | search dkim_selector=$dkim_selector$ dkim_domain=$dkim_domain$ source_type="$source_type$" source_name="$source_name$"
      | table *
    </query>
    <earliest>$time_range.earliest$</earliest>
    <latest>$time_range.latest$</latest>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="spf_aligned" searchWhenChanged="true">
      <label>SPF alignment</label>
      <choice value="*">any</choice>
      <choice value="true">true</choice>
      <choice value="false">false</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="dkim_aligned" searchWhenChanged="true">
      <label>DKIM alignment</label>
      <choice value="*">any</choice>
      <choice value="true">true</choice>
      <choice value="false">false</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="passed_dmarc" searchWhenChanged="true">
      <label>Passed DMARC</label>
      <choice value="*">any</choice>
      <choice value="true">true</choice>
      <choice value="false">false</choice>
      <default>*</default>
    </input>
    <input type="text" token="org_name" searchWhenChanged="true">
      <label>Reporting organization</label>
      <default>*</default>
    </input>
    <input type="text" token="header_from" searchWhenChanged="true">
      <label>Message header from</label>
      <default>*</default>
    </input>
    <input type="text" token="envelope_from" searchWhenChanged="true">
      <label>Envelope from</label>
      <default>*</default>
    </input>
    <input type="dropdown" token="disposition" searchWhenChanged="true">
      <label>Message disposition</label>
      <choice value="*">any</choice>
      <choice value="none">none</choice>
      <choice value="quarantine">quarantine</choice>
      <choice value="reject">reject</choice>
      <default>*</default>
    </input>
    <input type="text" token="source_ip_address" searchWhenChanged="true">
      <label>Source IP address</label>
      <default>*</default>
    </input>
    <input type="text" token="source_reverse_dns" searchWhenChanged="true">
      <label>Source reverse DNS</label>
      <default>*</default>
    </input>
    <input type="text" token="source_base_domain" searchWhenChanged="true">
      <label>Source base domain</label>
      <default>*</default>
    </input>
    <input type="dropdown" token="source_type" searchWhenChanged="true">
      <label>Source type</label>
      <default>*</default>
      <initialValue>*</initialValue>
      <choice value="*">any</choice>
      <fieldForLabel>source_type</fieldForLabel>
      <fieldForValue>source_type</fieldForValue>
      <search>
        <query>index="email" sourcetype="dmarc:aggregate"
        | stats count by source_type</query>
      </search>
    </input>
    <input type="dropdown" token="source_name" searchWhenChanged="true">
      <label>Source name</label>
      <default>*</default>
      <choice value="*">any</choice>
      <initialValue>*</initialValue>
      <fieldForLabel>source_name</fieldForLabel>
      <fieldForValue>source_name</fieldForValue>
      <search>
        <query>index="email" sourcetype="dmarc:aggregate" source_type="$source_type$"
        | stats count by source_name</query>
      </search>
    </input>
    <input type="text" token="source_country" searchWhenChanged="true">
      <label>Source country ISO code</label>
      <default>*</default>
    </input>
    <input type="text" token="dkim_selector" searchWhenChanged="true">
      <label>DKIM selector</label>
      <default>*</default>
    </input>
    <input type="text" token="dkim_domain" searchWhenChanged="true">
      <label>DKIM domain</label>
      <default>*</default>
    </input>
    <input type="time" token="time_range" searchWhenChanged="true">
      <label>Time range</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>SPF alignment</title>
      <chart>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by spf_aligned</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel>
      <title>DKIM alignment</title>
      <chart>
        <search base="base_search">
          <query> | stats sum(message_count) by dkim_aligned</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="height">250</option>
      </chart>
    </panel>
    <panel>
      <title>Passed DMARC</title>
      <chart>
        <search base="base_search">
          <query>| stats sum(message_count) by passed_dmarc</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Reporting organizations</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by org_name | sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="sum(message_count)">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Message sources by reverse DNS</title>
      <table>
        <search base="base_search">
          <query>| fillnull value="none" | stats sum(message_count) as message_count by source_base_domain | sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="sum(message_count)">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Message volume by header from</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by header_from  | sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="sum(message_count)">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Message sources by name and type</title>
      <table>
        <search base="base_search">
          <query> | stats sum(message_count) as message_count by source_name, source_type | sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>DMARC passage over time</title>
      <chart>
        <search base="base_search">
          <query>| timechart sum(message_count) as message_count by passed_dmarc</query>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Messages</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">right</option>
        <option name="height">280</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Message disposition over time</title>
      <chart>
        <search base="base_search">
          <query>| timechart sum(message_count) as message_count by disposition</query>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleY.text">Messages</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Message volume by source country</title>
      <map>
        <search base="base_search">
          <query> | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country"</query>
        </search>
        <option name="drilldown">none</option>
        <option name="height">566</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
  <row>
    <panel>
      <title>Source countries</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by source_country | sort -message_count</query>
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="sum(message_count)">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Message sources by IP address</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="message_count">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>SPF details</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by header_from,envelope_from,spf_result,spf_aligned,source_base_domain 
| sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="message_count">
          <option name="precision">0</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>DKIM details</title>
      <table>
        <search base="base_search">
          <query>| stats sum(message_count) as message_count by header_from,dkim_selector,dkim_domain,dkim_result,source_base_domain 
| sort -message_count</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
