[workbench_panel_aws_investigate_security_hub_alerts_by_dest]] label = Workbench - AWS Investigate Security Hub alerts by dest type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_investigate_user_activities_by_arn]] label = Workbench - AWS Investigate User Activities By ARN type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_investigate_user_activities_by_accesskeyid]] label = Workbench - AWS Investigate User Activities By AccessKeyId type = link fields = *accessKeyId* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_investigate_user_activities_by_source_user]] label = Workbench - AWS Investigate User Activities By Source User type = link fields = *src_user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_source_user&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_network_acl_details_from_id]] label = Workbench - AWS Network ACL Details from ID type = link fields = *networkAclId* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_network_interface_details_via_resourceid]] label = Workbench - AWS Network Interface details via resourceId type = link fields = *resourceId* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_aws_s3_bucket_details_via_bucketname]] label = Workbench - AWS S3 Bucket details via bucketName type = link fields = *bucketName* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_all_backup_logs_for_host]] label = Workbench - All backup logs for host type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_all_backup_logs_for_host&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_amazon_eks_kubernetes_activity_by_src_ip]] label = Workbench - Amazon EKS Kubernetes activity by src ip type = link fields = *src_ip* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_gcp_kubernetes_activity_by_src_ip]] label = Workbench - GCP Kubernetes activity by src ip type = link fields = *src_user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_gcp_kubernetes_activity_by_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_all_aws_activity_from_city]] label = Workbench - Get All AWS Activity From City type = link fields = *City* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_all_aws_activity_from_country]] label = Workbench - Get All AWS Activity From Country type = link fields = *Country* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_all_aws_activity_from_ip_address]] label = Workbench - Get All AWS Activity From IP Address type = link fields = *src_ip* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_all_aws_activity_from_region]] label = Workbench - Get All AWS Activity From Region type = link fields = *Region* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_authentication_logs_for_endpoint]] label = Workbench - Get Authentication Logs For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_authentication_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_backup_logs_for_endpoint]] label = Workbench - Get Backup Logs For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_backup_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_certificate_logs_for_a_domain]] label = Workbench - Get Certificate logs for a domain type = link fields = *domain* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_certificate_logs_for_a_domain&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_dns_server_history_for_a_host]] label = Workbench - Get DNS Server History for a host type = link fields = *src_ip* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_server_history_for_a_host&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_ec2_instance_details_by_instanceid]] label = Workbench - Get EC2 Instance Details by instanceId type = link fields = *instanceId* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_ec2_launch_details]] label = Workbench - Get EC2 Launch Details type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_email_info]] label = Workbench - Get Email Info type = link fields = *message_id* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_email_info&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_emails_from_specific_sender]] label = Workbench - Get Emails From Specific Sender type = link fields = *src_user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_emails_from_specific_sender&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address]] label = Workbench - Get First Occurrence and Last Occurrence of a MAC Address type = link fields = *src_mac* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_history_of_email_sources]] label = Workbench - Get History Of Email Sources type = link fields = *src* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_history_of_email_sources&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_logon_rights_modifications_for_endpoint]] label = Workbench - Get Logon Rights Modifications For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_logon_rights_modifications_for_user]] label = Workbench - Get Logon Rights Modifications For User type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_user&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_notable_history]] label = Workbench - Get Notable History type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_history&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_notable_info]] label = Workbench - Get Notable Info type = link fields = *event_id* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_info&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_process_responsible_for_the_dns_traffic]] label = Workbench - Get Process Responsible For The DNS Traffic type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_process_responsible_for_the_dns_traffic&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_registry_activities]] label = Workbench - Get Registry Activities type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_registry_activities&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_risk_modifiers_for_endpoint]] label = Workbench - Get Risk Modifiers For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_risk_modifiers_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_risk_modifiers_for_user]] label = Workbench - Get Risk Modifiers For User type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_risk_modifiers_for_user&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_update_logs_for_endpoint]] label = Workbench - Get Update Logs For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_update_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_user_information_from_identity_table]] label = Workbench - Get User Information from Identity Table type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_user_information_from_identity_table&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_vulnerability_logs_for_endpoint]] label = Workbench - Get Vulnerability Logs For Endpoint type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_vulnerability_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_get_web_session_information_via_session_id]] label = Workbench - Get Web Session Information via session id type = link fields = *session_id* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_web_session_information_via_session_id&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_aws_ecr_container_listing_activity]] label = Workbench - Investigate AWS ECR container listing activity type = link fields = *Compute.event_name* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_ecr_container_listing_activity&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_aws_user_activities_by_user_field]] label = Workbench - Investigate AWS User Activities by user field type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_aws_activities_via_region_name]] label = Workbench - Investigate AWS activities via region name type = link fields = *awsRegion* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_cloud_compute_instance_activities]] label = Workbench - Investigate Cloud Compute Instance Activities type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_cloud_compute_instance_activities&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_failed_logins_for_multiple_destinations]] label = Workbench - Investigate Failed Logins for Multiple Destinations type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_failed_logins_for_multiple_destinations&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_network_traffic_from_src_ip]] label = Workbench - Investigate Network Traffic From src ip type = link fields = *src_ip* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_network_traffic_from_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_okta_activity_by_ip_address]] label = Workbench - Investigate Okta Activity by IP Address type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_ip_address&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_okta_activity_by_app]] label = Workbench - Investigate Okta Activity by app type = link fields = *app* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_app&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_pass_the_hash_attempts]] label = Workbench - Investigate Pass the Hash Attempts type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_hash_attempts&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_pass_the_ticket_attempts]] label = Workbench - Investigate Pass the Ticket Attempts type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_ticket_attempts&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_previous_unseen_user]] label = Workbench - Investigate Previous Unseen User type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_previous_unseen_user&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_successful_remote_desktop_authentications]] label = Workbench - Investigate Successful Remote Desktop Authentications type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_successful_remote_desktop_authentications&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_user_activities_in_okta]] label = Workbench - Investigate User Activities In Okta type = link fields = *user* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_user_activities_in_okta&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_web_activity_from_host]] label = Workbench - Investigate Web Activity From Host type = link fields = *dest* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_activity_from_host&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_web_activity_from_src_ip]] label = Workbench - Investigate Web Activity From src ip type = link fields = *src_ip* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_activity_from_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_investigate_web_posts_from_src]] label = Workbench - Investigate Web POSTs From src type = link fields = *src* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_posts_from_src&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get [workbench_panel_process_chain_analysis]] label = Workbench - Process Chain Analysis type = link fields = *process_guid* display_location = field_menu link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_process_chain_analysis&drilldown_field=$@field_name$&use_drilldown_time=true link.target = blank link.method = get