event.category:network and host.os.type:macos and
process.name:(
    Claude or "Claude Helper" or "Claude Helper (Plugin)" or Copilot or Cursor or
    "Cursor Helper" or "Cursor Helper (Plugin)" or GPT4All or Jan or "Jan Helper" or
    KoboldCpp or "LM Studio" or Ollama or Windsurf or "Windsurf Helper" or
    "Windsurf Helper (Plugin)" or bunx or claude or codex or copilot or cursor or deno or
    gemini-cli or genaiscript or gpt4all or grok or jan or koboldcpp or llama-cli or
    llama-server or lmstudio or npx or ollama or pnpm or qwen or textgen or windsurf or yarn
) and destination.domain:(* and not (
    aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
    gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or
    ollama.com or openai.com or *.aka.ms or *.akamaized.net or *.amazonaws.com or
    *.amplitude.com or *.anthropic.com or *.atlassian.com or *.aws.amazon.com or
    *.azure.com or *.cdn.cloudflare.net or *.cloudflare-dns.com or *.cloudflare.com or
    *.cloudflarestorage.com or *.codeium.com or *.cursor.com or *.cursor.sh or
    *.datadoghq.com or *.elastic-cloud.com or *.elastic.co or *.exp-tas.com or
    *.gemini.google.com or *.generativelanguage.googleapis.com or *.github.com or
    *.githubcopilot.com or *.githubusercontent.com or *.gitkraken.com or *.gitkraken.dev or
    *.google.com or *.googleapis.com or *.gpt4all.io or *.grok.x.ai or *.hf.co or
    *.honeycomb.io or *.huggingface.co or *.intercom.io or *.jan.ai or *.launchdarkly.com or
    *.lmstudio.ai or *.microsoft.com or *.mixpanel.com or *.msedge.net or *.npmjs.com or
    *.npmjs.org or *.ollama.ai or *.ollama.com or *.openai.com or *.pypi.org or
    *.r2.cloudflarestorage.com or *.segment.io or *.sentry.io or *.visualstudio.com or
    *.vsassets.io or *.vscode-cdn.net or *.windsurf.ai or *.x.ai or *.yarnpkg.com
))