dataset = xdr_data
| filter action_process_image_sha256 in ("caa7667bfdbcb04ceb9d81df93fe805dfe4ac8a04b9dd3eaab7b5f7c87c4fc9c") or actor_process_image_sha256 in ("caa7667bfdbcb04ceb9d81df93fe805dfe4ac8a04b9dd3eaab7b5f7c87c4fc9c")
| fields agent_hostname, action_process_image_name, action_process_image_sha256, causality_actor_process_image_name, _time
| sort desc _time