# Collapse Events by RemoteHost, User, and Device
> Note: the way that this query runs can result in lost data if using the calculated Timestamp as a bookmark - this is due to how the events are collapsed by time.
```kusto
let ExcludeDomains = pack_array(
'microsoft.com',
'msn.com',
'live.com',
'office.com',
'office365.com',
'sharepoint.com',
'microsoftonline.com',
'grammarly.com',
'intel.com',
'office.net',
'bing.com',
'windows.com',
'windows.net',
'doubleclick.net',
'digicert.com',
'msedge.net',
'outlook.com',
'skype.com'
);
let DomainsRegex = strcat('(', replace_string(strcat_array(ExcludeDomains, '|'), '.', @'\.'), ')