config case_sensitive = false | preset=network_story | filter event_type = ENUM.NETWORK and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\mobsync.exe" and 
 (not 
 ((action_local_ip incidr "127.0.0.0/8" or 
 action_local_ip incidr "10.0.0.0/8" or 
 action_local_ip incidr "172.16.0.0/12" or 
 action_local_ip incidr "192.168.0.0/16" or 
 action_local_ip incidr "169.254.0.0/16" or 
 action_local_ip incidr "::1/128" or 
 action_local_ip incidr "fe80::/10" or 
 action_local_ip incidr "fc00::/7") or 
 (action_remote_ip incidr "127.0.0.0/8" or 
 action_remote_ip incidr "10.0.0.0/8" or 
 action_remote_ip incidr "172.16.0.0/12" or 
 action_remote_ip incidr "192.168.0.0/16" or 
 action_remote_ip incidr "169.254.0.0/16" or 
 action_remote_ip incidr "::1/128" or 
 action_remote_ip incidr "fe80::/10" or 
 action_remote_ip incidr "fc00::/7")))))