SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "URL"
FROM events
WHERE ("URL" ILIKE '%/autodiscover/autodiscover.json%' AND "URL" ILIKE '%@test.com/owa/?%') OR ("URL" ILIKE '%/autodiscover/autodiscover.json%' AND "URL" ILIKE '%@test.com/mapi/nspi/?%')
LAST 7 DAYS