preset = network_story
| filter action_remote_ip in ("185.172.128.146")
| fields agent_hostname, action_local_ip, action_remote_ip, action_remote_port, action_app_id, _time
| sort desc _time