Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?