SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "URL"
FROM events
WHERE ("URL" ILIKE '%/CFIDE/wizards/common/_logintowizard.cfm%' AND "URL" ILIKE '%%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%')
LAST 7 DAYS