<view template="dashboard.html">

  <module name="SideviewUtils" layoutPanel="appHeader" />
  <!-- The Time Range Picker feeds the picker for the MSADDomainSelector -->

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="default">Last 24 Hours</param>
    <param name="searchWhenChanged">True</param>

    <module name="FieldSearch" layoutPanel="panel_row1_col2">
      <param name="field">user</param>
      <param name="label">User Search</param>

      <module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
        <param name="search">eventtype=msad-account-lockout (host="NTBHI33" OR host="NTBHI34") | fillnull value="UNKNOWN" src_host | eval lockout=if(EventCode==644 OR EventCode==4740,"Yes","No") | stats latest(_time) as time,latest(src_host) as host,latest(lockout) as lockedout by dest_nt_domain,user | search lockedout="Yes" | eval ltime=strftime(time,"%c") | table time,ltime,dest_nt_domain,user,host | rename ltime as "Lockout Time",dest_nt_domain as "Domain",user as "Account Locked Out", host as "Lockout Source" | sort - time | fields - time</param>

        <module name="GenericHeader">
          <param name="label">Locked Accounts</param>
        </module>

        <module name="Pager">
          <param name="entityName">events</param>

          <module name="Table">

          </module>
        </module>
      </module>
    </module>
  </module>
</view>