dataset = xdr_data
| filter action_process_image_sha256 in ("a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2") or actor_process_image_sha256 in ("a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2")
| fields agent_hostname, action_process_image_name, action_process_image_sha256, action_process_image_md5, causality_actor_process_image_name, _time
| sort desc _time