...
- Free text search: "bwalth01" or "130.64.205.66"
- All Juniper VPN activity: deviceVendor contains "Juniper" AND deviceProduct = "Netscreen VPN"
- All traffic going to a particular IP: destinationAddress = "94.100.18.41"
- All traffic to a set of IP addresses: destinationAddress IN ["130.64.205.66","130.64.205.72","130.64.205.178"]
- All failed login attempts: categoryBehavior CONTAINS "Verify" AND categoryOutcome = "/Failure"
...