The following TQL queries are for the http_proxy metaclass.
Identify IPs requested as direct URLs
metaclass:http_proxy !domain:10.* domain:/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ | groupby domainIdentify potential data theft through pastebin.com
Identify all source IPv4 addresses that uploaded compromised text documents with a payload size greater than 0 to pastebin.com.
metaclass:http_proxy domain:"pastebin.com" (httpmethod:["put","post"]) sentbytes>0 | groupby [srcipv4,sentbytes]
Identify least frequently used useragent strings
metaclass:http_proxy | groupby < useragent 50