# Collapse Events by RemoteHost, User, and Device > Note: the way that this query runs can result in lost data if using the calculated Timestamp as a bookmark - this is due to how the events are collapsed by time. ```kusto let ExcludeDomains = pack_array( 'microsoft.com', 'msn.com', 'live.com', 'office.com', 'office365.com', 'sharepoint.com', 'microsoftonline.com', 'grammarly.com', 'intel.com', 'office.net', 'bing.com', 'windows.com', 'windows.net', 'doubleclick.net', 'digicert.com', 'msedge.net', 'outlook.com', 'skype.com' ); let DomainsRegex = strcat('(', replace_string(strcat_array(ExcludeDomains, '|'), '.', @'\.'), ') ); DeviceNetworkEvents | where Timestamp >= ago(6h) | top 10000 by Timestamp asc | where (isnotempty(RemoteUrl) and isnotnull(RemoteUrl)) | where InitiatingProcessAccountName !in~ ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE') | where (RemoteUrl matches regex DomainsRegex or RemoteUrl matches regex @'^[^\.]*) == false | extend UrlInfo= parse_url(RemoteUrl) | evaluate bag_unpack(UrlInfo) | extend RemoteHost=replace(@'(:|\/).*', '', case(isnotempty(Host) and isnotnull(Host), Host, RemoteUrl)) | extend Packed=pack( 'Timestamp', Timestamp, 'ReportId',ReportId, 'ActionType',ActionType, 'AppGuardContainerId',AppGuardContainerId, 'AdditionalFields',AdditionalFields, 'InitiatingProcessParentId',InitiatingProcessParentId, 'InitiatingProcessIntegrityLevel',InitiatingProcessIntegrityLevel, 'LocalPort',LocalPort, 'InitiatingProcessCommandLine',InitiatingProcessCommandLine, 'InitiatingProcessCreationTime',InitiatingProcessCreationTime, 'InitiatingProcessFolderPath',InitiatingProcessFolderPath, 'InitiatingProcessParentFileName',InitiatingProcessParentFileName, 'InitiatingProcessAccountDomain',InitiatingProcessAccountDomain, 'InitiatingProcessAccountName',InitiatingProcessAccountName, 'InitiatingProcessAccountSid',InitiatingProcessAccountSid, 'InitiatingProcessAccountUpn',InitiatingProcessAccountUpn, 'InitiatingProcessAccountObjectId',InitiatingProcessAccountObjectId, 'InitiatingProcessTokenElevation',InitiatingProcessTokenElevation, 'InitiatingProcessSHA1',InitiatingProcessSHA1, 'InitiatingProcessSHA256',InitiatingProcessSHA256, 'InitiatingProcessMD5',InitiatingProcessMD5, 'InitiatingProcessFileName',InitiatingProcessFileName, 'InitiatingProcessFileSize',InitiatingProcessFileSize, 'InitiatingProcessVersionInfoCompanyName',InitiatingProcessVersionInfoCompanyName, 'InitiatingProcessVersionInfoProductName',InitiatingProcessVersionInfoProductName, 'InitiatingProcessVersionInfoProductVersion',InitiatingProcessVersionInfoProductVersion, 'InitiatingProcessVersionInfoInternalFileName',InitiatingProcessVersionInfoInternalFileName, 'InitiatingProcessVersionInfoOriginalFileName',InitiatingProcessVersionInfoOriginalFileName, 'InitiatingProcessVersionInfoFileDescription',InitiatingProcessVersionInfoFileDescription, 'InitiatingProcessId',InitiatingProcessId, 'InitiatingProcessParentCreationTime',InitiatingProcessParentCreationTime, 'RemotePort',RemotePort, 'RemoteUrl', RemoteUrl ) | project-away ActionType, ReportId, AppGuardContainerId, AdditionalFields, InitiatingProcessParentId, InitiatingProcessIntegrityLevel, LocalPort, InitiatingProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessFolderPath, InitiatingProcessParentFileName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessAccountUpn, InitiatingProcessAccountObjectId, InitiatingProcessTokenElevation, InitiatingProcessSHA1, InitiatingProcessSHA256, InitiatingProcessMD5, InitiatingProcessFileName, InitiatingProcessFileSize, InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoProductName, InitiatingProcessVersionInfoProductVersion, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessVersionInfoFileDescription, InitiatingProcessId, InitiatingProcessParentCreationTime, RemotePort, RemoteUrl | extend TimestampRoundedMinutes=todatetime(format_datetime(Timestamp, 'yyyy-MM-dd HH:mm')) | extend TP=case(TimestampRoundedMinutes % 2m == 0m, TimestampRoundedMinutes, TimestampRoundedMinutes - 1m) | summarize Events=make_set(Packed), OldestTimestamp=arg_max(Timestamp, TP), EarliestTimestamp=arg_min(Timestamp, TP), Timestamp=arg_min(Timestamp, TP), TotalEventsForPeriod=count() by DeviceId, DeviceName, RemoteIP, RemoteHost, LocalIP, Protocol, LocalIPType, RemoteIPType, TP | project-away TP* | extend EpochMS=tolong((Timestamp - datetime(1970-01-01)) / 1ms) | extend AltDatetime = strcat(format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss'), ' GMT+00:00') ```