diff --git a/dashboards/risk_notable_analysis_dashboard.xml b/dashboards/risk_notable_analysis_dashboard.xml
index 6acc4b7..8cc6b12 100644
--- a/dashboards/risk_notable_analysis_dashboard.xml
+++ b/dashboards/risk_notable_analysis_dashboard.xml
@@ -70,15 +70,24 @@
$risk_drilldown$
- | tstats summariesonly=true count dc(All_Risk.risk_object) as dc_objects dc(All_Risk.src) as dc_src dc(All_Risk.dest) as dc_dest dc(All_Risk.user) as dc_users dc(All_Risk.user_bunit) as dc_bunit sum(All_Risk.calculated_risk_score) as risk_sum values(All_Risk.calculated_risk_score) as risk_scores from datamodel=Risk.All_Risk where source="$risk_drilldown$" by All_Risk.threat_object,All_Risk.threat_object_type | `drop_dm_object_name("All_Risk")` | sort 1000 - risk_sum
+ | from datamodel Risk.All_Risk
+| search source="$risk_drilldown$"
+| stats count dc(risk_object) as dc_objects list(threat_object) as threat_object list(threat_object_type) as threat_object_type dc(src) as dc_src dc(dest) as dc_dest dc(user) as dc_users dc(user_bunit) as dc_bunit sum(calculated_risk_score) as risk_sum values(calculated_risk_score) as risk_scores by risk_object
+| eval threat_object_type = mvmap(threat_object_type, "(" . threat_object_type . ")")
+| eval threat_object_combined = mvdedup(mvzip(threat_object, threat_object_type, " "))
+| fields - threat_object, threat_object_type
+| mvexpand threat_object_combined
+| stats count max(dc_objects) as dc_objects values(threat_object_combined) as threat_object max(dc_src) as dc_src max(dc_dest) as dc_dest max(dc_users) as dc_users max(dc_bunit) as dc_bunit max(risk_sum) as risk_sum values(risk_scores) as risk_scores by risk_object
+| sort 1000 - risk_sum
$time_picker.earliest$
$time_picker.latest$
+
+
+
[#a7c4f2]
-
-
search?q=$search_spl$&earliest=$early_time$&latest=$time_picker.latest$
@@ -90,4 +99,4 @@
-
\ No newline at end of file
+