config case_sensitive = false | preset=network_story | filter event_type = ENUM.NETWORK and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (((action_external_hostname in ("www.ip.cn", "l2.io")) or 
 (action_external_hostname in ("*api.2ip.ua*", "*api.bigdatacloud.net*", "*api.ipify.org*", "*bot.whatismyipaddress.com*", "*canireachthe.net*", "*checkip.amazonaws.com*", "*checkip.dyndns.org*", "*curlmyip.com*", "*db-ip.com*", "*edns.ip-api.com*", "*eth0.me*", "*freegeoip.app*", "*geoipy.com*", "*getip.pro*", "*icanhazip.com*", "*ident.me*", "*ifconfig.io*", "*ifconfig.me*", "*ip-api.com*", "*ip.360.cn*", "*ip.anysrc.net*", "*ip.taobao.com*", "*ip.tyk.nu*", "*ipaddressworld.com*", "*ipapi.co*", "*ipconfig.io*", "*ipecho.net*", "*ipinfo.io*", "*ipip.net*", "*ipof.in*", "*ipv4.icanhazip.com*", "*ipv4bot.whatismyipaddress.com*", "*ipv6-test.com*", "*ipwho.is*", "*jsonip.com*", "*myexternalip.com*", "*seeip.org*", "*wgetip.com*", "*whatismyip.akamai.com*", "*whois.pconline.com.cn*", "*wtfismyip.com*"))) and 
 (not 
 (actor_process_image_path contains "\brave.exe" or 
 (actor_process_image_path in ("C:\Program Files\Google\Chrome\Application\chrome.exe", "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) or 
 (actor_process_image_path in ("C:\Program Files\Mozilla Firefox\firefox.exe", "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) or 
 (actor_process_image_path in ("C:\Program Files (x86)\Internet Explorer\iexplore.exe", "C:\Program Files\Internet Explorer\iexplore.exe")) or 
 actor_process_image_path contains "\maxthon.exe" or 
 (actor_process_image_path contains "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\" or 
 actor_process_image_path contains "\WindowsApps\MicrosoftEdge.exe" or 
 (actor_process_image_path in ("C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe", "C:\Program Files\Microsoft\Edge\Application\msedge.exe"))) or 
 ((actor_process_image_path in ("C:\Program Files (x86)\Microsoft\EdgeCore\*", "C:\Program Files\Microsoft\EdgeCore\*")) and 
 (actor_process_image_path in ("*\msedge.exe", "*\msedgewebview2.exe"))) or 
 actor_process_image_path contains "\opera.exe" or 
 actor_process_image_path contains "\safari.exe" or 
 actor_process_image_path contains "\seamonkey.exe" or 
 actor_process_image_path contains "\vivaldi.exe" or 
 actor_process_image_path contains "\whale.exe"))))