SELECT sourceip, destinationip, QIDNAME(qid) AS event, "URL Host", "URL"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: Malicious URLs', "URL")
LAST 7 DAYS