SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, "URL Host"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: Malicious Domains', "URL Host")
LAST 7 DAYS