SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, "URL Host"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: WindShift - domains', "URL Host")
LAST 7 DAYS