Feedback:
About AQL Visualization Types
Anomali Query Language (AQL) dashboards support multiple visualization types. These visualizations support both the eventlog and OCSF Version 1.2 schema fields with dotted notation. For more information on using OCSF fields in queries and visualizations, see OCSF Schema Overview.
When Schema RBAC is active for your organization, the schema filters in your assigned roles determine which data this feature returns. An eventlog filter limits your results to only the eventlog data your role permits, and an OCSF filter limits your results to only the OCSF data your role permits. If a query runs against a schema for which your role has no filter assigned, the query returns a forbidden error. For details, see Role-Based Access Control for Schemas.