Help creating custom Dataset for IPS report

Please try:

Log Type: intrusion prevention

select attack, vuln_type, srcip, dstip, min($calendar_time) as first_seen, max($calendar_time) as last_seen, count(*) as totalnum, t1.severity  from $log t1 left join ips_mdata t2 on t1.attack=t2.name where $filter and vuln_type is not null group by attack,vuln_type,srcip, dstip, t1.severity order by totalnum desc

hz