...
When building a query, if you are not familiar with the data fields available, hovering on the columns reveals the data field name to use to build the query. For example, knowing the field name is upload_bytes one can construct queries to limit to data with upload_bytes > 1000:>1000.
...
Blue Hexagon NDR Threat Hunting Guide
...