dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "rclone.exe" and (lowercase(action_process_image_command_line) contains " copy " or lowercase(action_process_image_command_line) contains " sync ")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time