The following TQL queries are for non-specific evidence.
Identify directory traversal attempts that do not originate from the trusted network 10.0.0.0 grouped by source IP address and URI
!srcisp:"private ip address lan" !srcipv4:10.0.0* uri:"/../../*" | groupby [srcipv4,uri]
Identify traffic being routed through countries that are not the US, Canada, or India grouped by destination country
!dstisp:"private ip address lan" !dstcountry:["united states", "canada","india"] | groupby dstcountry 1000
Identify files being transferred to Russia grouped by mimetype
dstcountry:"russian federation" | groupby mimetype 100
Identify unencrypted (non-proxied) traffic greater than 1MB grouped by mimetype
!class:bluecoat_http_proxy class:bro_files !service:ssl bytes>1000000 !dstisp:["<target corporation>","ip address lan"] | groupby [mimetype]
Identify unencrypted (non-proxied) traffic greater than 1GB grouped by source IP address and destination ISP
!class:bluecoat_http_proxy metaclass:file_xfer !dstisp:["private ip address lan","<target corporation>"] bytes>10000000 | groupby [srcipv4,dstisp]
Identify HTTP traffic that is leaking around the BlueCoat web proxy
!class:bluecoat_http_proxy metaclass:http_proxy !dstisp:["private ip address lan","<target corporation>"] | groupby [srcipv4,dstisp]
Identify inside to outside traffic (non-proxied) greater than 1GB and grouped by service type
srcipv4="10.0.0.0/8" dstipv4!="10.0.0.0/8" dstipv4!=" 172.0.0.0/8" dstipv4!="161.0.0.0/8" dstipv4!="162.0.0.0/8" seenbytes>10000000 |groupby service