Event Hunt
Preset Hunts
Query a device's retained logs with endpoint:FINANCE-WS-01, then add eventType:dns_query or commandLine:backup. Use from:2026-07-01 to:2026-07-19 for a UTC window (to is exclusive). Without an exact device, queries cover the recorded tenant sample. Older daily summaries contain totals, not individual events.
Search in: