[Sophos Firewall / Data Lake] Identify Attempts to Access Firewall by Country

SELECT
   device_model,
   --device_serial_id,
   --app_name AS ProtoPort,
   --in_interface,--
   --src_mac,--
   src_ip,
   dst_ip,
   src_country,
   log_type AS Source_Log,
   log_subtype AS Decision,
   src_port,
   dst_port
   --protocol--
FROM xgfw_data

--Use % if unsure--
WHERE src_country LIKE '$$Source Country Name$$'
AND src_country != 'Reserved'
AND src_ip != '11.11.10.%'