SELECT sourceip, username, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "File Hash"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: global - file hashs', "File Hash")
LAST 7 DAYS