dataset = xdr_data
| filter dns_query_name in ("acortaurl.com", "cort.as", "gtly.to") or action_external_hostname in ("acortaurl.com", "cort.as", "gtly.to")
| fields agent_hostname, dns_query_name, action_external_hostname, _time
| sort desc _time