dataset = panw_ngfw_url_raw
| filter (uri contains "/CFIDE/wizards/common/_logintowizard.cfm" and uri contains "%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E")
| fields _time, source_ip, dest_ip, url_domain, uri, url_category
| sort desc _time