preset = network_story
| filter action_remote_ip in ("104.238.141.143", "158.247.199.37", "195.85.114.78", "45.32.41.202")
| fields agent_hostname, action_local_ip, action_remote_ip, action_remote_port, action_app_id, _time
| sort desc _time