Copy and Paste into SIEM Search Bar

SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_provider AS event_provider, new_logs.event_code_string AS ecs_event_code, new_logs.host_hostname AS host_hostname, new_logs.user_name AS user_name, new_logs.ecs_fields['target.user.name'] AS ecs_target_user_name, new_logs.ecs_fields['winlog.event_data.ShutdownActionType'] AS ecs_winlog_event_data_ShutdownActionType, new_logs.ecs_fields['winlog.event_data.ShutdownReason'] AS ecs_winlog_event_data_ShutdownReason, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 30971 AND new_logs.agent_id = 12637506 AND new_logs.uuid >= '019fc771-ecc0-7000-8000-000000000000' AND new_logs.uuid < '019fc84d-a6c0-7000-8000-000000000000' AND (new_logs.event_provider = 'Microsoft-Windows-Kernel-Power' OR new_logs.event_provider = 'Microsoft-Windows-Security-Auditing') AND (new_logs.event_code = 41 OR new_logs.event_code = 1074 OR new_logs.event_code = 6008 OR new_logs.event_code = 4720 OR new_logs.event_code = 4722 OR new_logs.event_code = 4725 OR new_logs.event_code = 4726 OR lower(new_logs.message) ILIKE '%install%') ORDER BY new_logs.uuid DESC LIMIT 100