LKML
Internet security
Authlog
Authlog model for internet security.
inferred
Blocks
authlog.view.lkml · 135 lines
inferred
view: authlog {
sql_table_name: public.authlog ;;
dimension: id {
type: int
primary_key: yes
sql: ${TABLE}.id ;;
}
dimension: akey {
sql: ${TABLE}.akey ;;
}
dimension: ator_ip {
sql: ${TABLE}.ator_ip ;;
}
dimension: ator_first_octet {
sql: SPLIT_PART(${ator_ip}, '.',1) ;;
}
dimension: ator_ip_v4bin {
type: number
sql: ${TABLE}.ator_ip_v4bin ;;
}
dimension: ator_ip_v6bin {
type: number
hidden: yes
sql: ${TABLE}.ator_ip_v6bin ;;
}
dimension: enroll {
type: yesno
sql: ${TABLE}.enroll ;;
}
dimension: factor {
sql: ${TABLE}.factor ;;
}
dimension: is_human_factor {
type: yesno
sql: ${factor} IN ('App Push','Passcode','Phone Call','SMS Passcode','U2F Token') ;;
}
dimension: flash_version {
sql: ${TABLE}.flash_version ;;
}
dimension: condensed_flash_version {
sql: CASE WHEN ${flash_version} IN
(SELECT * FROM
(
SELECT
authlog.flash_version AS flash_version
FROM public.authlog AS authlog
WHERE {% condition authlog.ts_date %} authlog.ts {% endcondition %}
AND flash_version <> ''
GROUP BY 1
ORDER BY COUNT(*) DESC
LIMIT 10
) sub
)
THEN ${flash_version}
ELSE 'Other'
END ;;
}
dimension: has_flash {
type: yesno
sql: ${flash_version} != '' AND ${flash_version} != 'uninstalled' ;;
}
dimension: iname {
sql: ${TABLE}.iname ;;
}
dimension: ipaddr {
sql: ${TABLE}.ipaddr ;;
}
dimension: ipaddr_v4bin {
type: number
sql: ${TABLE}.ipaddr_v4bin ;;
}
dimension: ipaddr_v6bin {
type: number
sql: ${TABLE}.ipaddr_v6bin ;;
}
dimension: java_version {
sql: ${TABLE}.java_version ;;
}
dimension: has_java {
type: yesno
sql: ${java_version} != '' AND ${java_version} != 'uninstalled' ;;
}
dimension: result {
sql: ${TABLE}.result ;;
}
dimension: uname {
sql: ${TABLE}.uname ;;
}
dimension_group: ts {
type: time
timeframes: [time, date, week, month]
sql: ${TABLE}.ts ;;
}
measure: count {
type: count
drill_fields: [id, iname, uname]
}
measure: column_percent {
type: percent_of_total
sql: ${count} ;;
}
measure: count_unique_users {
type: count_distinct
sql: ${uname} ;;
}
measure: percent_of_unique_users {
type: percent_of_total
sql: ${count_unique_users} ;;
}
}
authlog.view.lookml · 92 lines
source-preserved
- view: authlog
sql_table_name: public.authlog
fields:
- dimension: id
type: int
primary_key: true
sql: ${TABLE}.id
- dimension: akey
sql: ${TABLE}.akey
- dimension: ator_ip
sql: ${TABLE}.ator_ip
- dimension: ator_first_octet
sql: SPLIT_PART(${ator_ip}, '.',1)
- dimension: ator_ip_v4bin
type: number
sql: ${TABLE}.ator_ip_v4bin
- dimension: ator_ip_v6bin
type: number
hidden: true
sql: ${TABLE}.ator_ip_v6bin
- dimension: enroll
type: yesno
sql: ${TABLE}.enroll
- dimension: factor
sql: ${TABLE}.factor
- dimension: is_human_factor
type: yesno
sql: ${factor} IN ('App Push','Passcode','Phone Call','SMS Passcode','U2F Token')
- dimension: flash_version
sql: ${TABLE}.flash_version
- dimension: condensed_flash_version
sql: CASE WHEN ${flash_version} IN
(SELECT * FROM
(
SELECT
authlog.flash_version AS flash_version
FROM public.authlog AS authlog
WHERE {% condition authlog.ts_date %} authlog.ts {% endcondition %}
AND flash_version <> ''
GROUP BY 1
ORDER BY COUNT(*) DESC
LIMIT 10
) sub
)
THEN ${flash_version}
ELSE 'Other'
END
- dimension: has_flash
type: yesno
sql: ${flash_version} != '' AND ${flash_version} != 'uninstalled'
- dimension: iname
sql: ${TABLE}.iname
- dimension: ipaddr
sql: ${TABLE}.ipaddr
- dimension: ipaddr_v4bin
type: number
sql: ${TABLE}.ipaddr_v4bin
- dimension: ipaddr_v6bin
type: number
sql: ${TABLE}.ipaddr_v6bin
- dimension: java_version
sql: ${TABLE}.java_version
- dimension: has_java
type: yesno
sql: ${java_version} != '' AND ${java_version} != 'uninstalled'
- dimension: result
sql: ${TABLE}.result
- dimension: uname
sql: ${TABLE}.uname
- dimension_group: ts
type: time
timeframes:
- time
- date
- week
- month
sql: ${TABLE}.ts
- measure: count
type: count
drill_fields:
- id
- iname
- uname
- measure: column_percent
type: percent_of_total
sql: ${count}
- measure: count_unique_users
type: count_distinct
sql: ${uname}
- measure: percent_of_unique_users
type: percent_of_total
sql: ${count_unique_users}
Contents
- authlog.view.lkml
- authlog.view.lookml