Copy and paste into SIEM Search Bar (replace XXXX with specific values)

SELECT all_logs.uuid, all_logs.organization_id, all_logs.event_provider AS event_provider, all_logs.event_code_string AS ecs_event_code, all_logs.ecs_fields['source.ip'] AS ecs_source_ip, all_logs.ecs_fields['client.ip'] AS ecs_client_ip, all_logs.ecs_fields['winlog.event_data.IpAddress'] AS ecs_winlog_event_data_IpAddress, all_logs.ecs_fields['itdr.ClientIP'] AS ecs_itdr_ClientIP, all_logs.host_hostname AS host_hostname, all_logs.ecs_fields['user.email'] AS ecs_user_email, all_logs.message FROM all_logs AS logs WHERE all_logs.account_id = XXXX AND all_logs.agent_id = XXXXX AND all_logs.uuid >= 'XXXXXXXXXXXXX' AND all_logs.uuid < 'XXXXXXXXXXXXXXXX' AND (mapContains(all_logs.ecs_fields, 'source.ip') = 1 AND all_logs.ecs_fields['source.ip'] = '10.1.13.50' OR mapContains(all_logs.ecs_fields, 'client.ip') = 1 AND all_logs.ecs_fields['client.ip'] = 'xx.x.xx.xx' OR mapContains(all_logs.ecs_fields, 'winlog.event_data.IpAddress') = 1 AND all_logs.ecs_fields['winlog.event_data.IpAddress'] = 'xx.x.xx.xx' OR mapContains(all_logs.ecs_fields, 'itdr.ClientIP') = 1 AND all_logs.ecs_fields['itdr.ClientIP'] = 'xx.x.xx.xx) ORDER BY all_logs.uuid DESC LIMIT 100