index="REPLACE_WITH_WEB_INDEX" earliest="08/01/2026:00:00:00" latest=now
    (src IN ("3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120", "213.163.202.171", "221.216.140.49", "221.216.140.129")
    OR http_user_agent IN ("Metabase-GHSA-vwf4/2.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"))
| eval case=case(in(src, "213.163.202.171", "221.216.140.49", "221.216.140.129") OR http_user_agent=="Metabase-GHSA-vwf4/2.0", "C (Metabase)",
    in(src, "3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120"), "B (app or API)", true(), "User-Agent only")
| eval tool_ua=if(in(http_user_agent, "curl/7.88.1", "python-requests/2.34.2", "python-requests/2.33.1"), 1, 0)
| stats min(_time) AS first_seen max(_time) AS last_seen count AS events sum(tool_ua) AS with_tool_ua
    values(http_user_agent) AS user_agents values(status) AS statuses dc(url) AS distinct_urls values(dest) AS targets BY case src
| convert ctime(first_seen) ctime(last_seen)
| sort 0 case -events
| head 200