I am trying to create a report layout based on a custom view I created. What is the best way to do this? If this is not possible, I would like to create a custom event query based on Threat_Name but I am not able to copy a pre-made query and change the fields. For example, I wanted to copy the Summary event query, remove the Rule Message and Signature ID fields, and add the Threat_Name field. Can anyone help me out with this?
I should have mentioned I was looking to create a table in a view. I am able to get what I need from a bar chart.