dataset = panw_ngfw_url_raw
| filter (uri contains "/autodiscover/autodiscover.json" and uri contains "@test.com/owa/?") or (uri contains "/autodiscover/autodiscover.json" and uri contains "@test.com/mapi/nspi/?")
| fields _time, source_ip, dest_ip, url_domain, uri, url_category
| sort desc _time