Public event hunting query
spl
· Evidence-linked query artifact; local execution not performed.
index=* ("PaperCut" OR "NG/MF") | stats count by host, user, process_nameindex=* ("PaperCut" OR "NG/MF") | stats count by host, user, process_name