dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "wevtutil.exe" and (lowercase(action_process_image_command_line) contains " cl " or lowercase(action_process_image_command_line) contains " clear-log ")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time