{
  "from": 0,
  "size": 1000,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "detectDateTime": {
              "from": "xxxx-xx-xxSxx:xx:xx.000+0000",
              "to": "xxxx-xx-xxExx:xx:xx.000+0000",
              "include_lower": true,
              "include_upper": true,
              "boost": 1
            }
          }
        },
        {
          "terms": {
            "actionType": [
              13
            ],
            "boost": 1
          }
        },
        {
          "terms": {
            "isVisible": [
              true
            ],
            "boost": 1
          }
        },
        {
          "bool": {
            "should": [
              {
                "terms": {
                  "isOrdinary": [
                    true
                  ],
                  "boost": 1
                }
              },
              {
                "bool": {
                  "must_not": [
                    {
                      "exists": {
                        "field": "isOrdinary",
                        "boost": 1
                      }
                    }
                  ],
                  "adjust_pure_negative": true,
                  "boost": 1
                }
              }
            ],
            "adjust_pure_negative": true,
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  },
  "_source": {
    "includes": [
      "serialId",
      "source.logonName",
      "source.department",
      "source.fqdn",
      "detectDateTime",
      "channelType",
      "source.mail",
      "source.ipAddress",
      "matchedPolicies.name",
      "classificationLevelNames",
      "extendIncidentRules.name",
      "tagNames",
      "destinations.displayName",
      "attachments.filename",
      "attachments.fileSize",
      "attachments.fileMd5"
    ],
    "excludes": [
      "matchedPolicies.matchedRules.matchedConditions"
    ]
  },
  "sort": [
    {
      "detectDateTime": {
        "order": "desc"
      }
    }
  ],
  "track_total_hits": 2147483647
}