"Given the already existing Clickhouse Table 'Telemetry' with column names and types:
 
[InsertionDateTime DateTime('Etc/UTC'),
TTLDays UInt16,
TimeStamp DateTime64(9,'Etc/UTC'): Fecha y hora del evento con alta precisión (nanosegundos),
Date Date: Fecha asociada al evento,
DateTime DateTime('Etc/UTC'): Fecha y hora asociada al evento,
PandaDateTime DateTime64(9,'Etc/UTC'),
PandaTimeStatus Int8,
Muid LowCardinality(FixedString(32)): Identificador único de una máquina/ordenador,
DeviceId LowCardinality(FixedString(32)),
AccountId LowCardinality(String): Identificador único del cliente,
EventType UInt16: Tipo de evento
	Ejemplos: {0:"Evento de status con informacion de maquina",1:"Evento relacionado con operaciones interceptadas en procesos",3:"ProcessUnandledException",4:"Evento relacionado con la subida de un fichero",5:"CriticalSoftInfo",6:"BackendFileRequest",9:"CacheStatus",10:"CloudSettings",11:"Service Error",12:"InstalledSoft",13:"UnistalledSoft",14:"Evento relacionado con la descarga de un fichero desde una URL",15:"HostFileModification",16:"FileAge",17:"DriverSvcCreation",18:"DriverSvcOpen",19:"Counters",20:"SetWindowsHook",21:"UnhookWindowsHook",22:"Evento relacionado con las comunicaciones de red de una máquina",23:"ExploitDownload",24:"Evento relacionado con los bloqueos o tostadas de un fichero",25:"EventNotBlocked",26:"MonitoredOpen",27:"MonitoredRegistry",28:"AssetDiscovery",29:"InstallUninstall",30:"ScriptCreation",31:"ScriptLaunch",40:"Evento relacionado con las detecciones en una maquina asociadas a un fichero",41:"Evento relacionado con las detecciones de IOCs en la maquina",42:"ByteProcess",45:"SysMon",46:"FailedDNSQuerys",47:"DeviceControl",48:"DNSTunneling",50:"ToastBlockReason",51:"URL",52:"LoginLogout",60:"Error",61:"ErrorEventAgent",99:"Evento relacionado con las acciones tomadas en la maquina, como bloqueo, whitelist, etc.",100:"Cabecera de la maquina",101:"OverQuota",198:"HIDDEN ACTION",201:"Altitude",300:"DataLeakPrevention",301:"Data Control Correo"},
Operation UInt8: Tipo de operación realizada en el archivo/proceso
	Ejemplos: {0:"Se corresponde a la ejecucion del fichero",1:"Se corresponde a la creacion del fichero",2:"Se corresponde a la modificacion del fichero",3:"Se corresponde a la carga de librerias, que tambien se considera ejecucion",4:"SvcInst",5:"PEMapWrite",6:"Se crresponde a la eliminacion del fichero",7:"Se corresponde al renombrado del nombre del fichero",8:"Se corresponde a la creacion de un directorio o ruta",9:"CMPCreat se refiere a la creación de un fichero comprimido",10:"CMOpened se refiere a la apertura de un fichero comprimido",11:"Se corresponde a la creacion de clave de registro",12:"Se corresponde a la modificacion de clave de registro",15:"PENeverSeen",17:"RemoteThreadCreated",18:"ProcessKilled",25:"SamAccess",27:"Exploit VBS (Legacy)",28:"Exploit Python (Legacy)",29:"Exploit Ruby (Legacy)",30:"Exploit Sniffer (Legacy)",31:"Exploit WSAStartup",32:"Exploit InternetReadFile (Legacy)",34:"Exploit CMD",39:"Carga de fichero d 16bits por ntvdm.exe",43:"Heuhooks (envío de detección de hooks)",52:"apertura de fichero en MAC",53:"apertura de fichero en Linux",54:"CREATE_PROCESS_BY_WMI",55:"AttackProduct",61:"OpenProcessLSASS",89:"LoadDrvVulnerable (BYOVD)",200:"MITRE_READ_COMPLETE",201:"MITRE_CREATE_FILE",202:"MITRE_MODIFY_FILE",207:"MITRE LoadDriver",208:"MITRE_NOPE_Delete"},
MuidLegacy LowCardinality(FixedString(32)),
ParentStatus Int8,
ParentCountU Int8,
ParentPid UInt64: ID del proceso del archivo padre,
ParentMd5 FixedString(32): Identificador único (hash) del archivo padre,
ParentDrive Int8,
ParentPath String: Ruta del archivo padre en el sistema,
ParentFilename String: Nombre del archivo padre,
ParentAttributes UInt64,
ParentBlake FixedString(64),
ChildStatus Int8,
ChildPid UInt64: ID del proceso del archivo hijo,
ChildMd5 FixedString(32): Identificador único (hash) del archivo hijo,
ChildDrive Int8,
ChildPath String: Ruta del archivo hijo en el sistema,
ChildFilename String): Nombre del archivo hijo,
ChildAttributes UInt64,
ChildClassification Int8: Clasificación del archivo hijo sobre el que se realizó la acción. Hay 10 tipos
	Ejemplos: {0:"Unknown",1:"Goodware",2:"Malware",3:"Suspect",4:"Compromised",5:"GWNotConfirmed",6:"Pup",7:"GwUnwanted",8:"GwRanked"},
ChildBlake FixedString(64),
ChildFiletime String,
ChildFirstSeen DateTime('Etc/UTC'),
ChildFileSize UInt64,
WinningTech Int8,
DetectionId UInt32: Identificador único de detección de un archivo,
Action Int8: Identifica la acción realizada sobre un MD5. Hay 40 acciones posibles
	Ejemplos: {-1:"Undefined",0:"Allow",1:"Block",2:"BlockTimeout",3:"AllowWL",4:"BlockBL",5:"Disinfect",6:"Delete",7:"Quarantine",8:"AllowByUser",9:"Informed",10:"Unquarantine",11:"Rename",12:"BlockURL",13:"KillProcess",14:"BlockExploit",15:"ExploitAllowByUser",16:"RebootNeeded",17:"ExploitInformed",18:"AllowSonGWInstaller",19:"EmbebedInformed",20:"EmbebedBlocked",21:"SuspedProcess",22:"ModifyDiskResource",23:"ModifyRegistry",24:"RenameRegistry",25:"ModifyMarkFile",26:"UncertainAction",27:"ResponseLast",28:"AllowFGW",29:"AllowSWAuthoriced",30:"InformNewPE",31:"ExploitAllowByAdmin",32:"IPBlocked",33:"AllowSonMsiGW",34:"IsolateHost",35:"RDPOff",36:"UnisolateHost",37:"AllowbyGlobalAudit",38:"AllowByConfig"},
ServiceLevel Int8,
RemediationResult Int8,
BlockReason Int8,
AccNube Int8,
LastQuery DateTime('Etc/UTC'),
ActionType Int8,
SessionType Int32,
ErrorCodeU Int32,
DataContainer String,
ExtendedInfo String,
IsLocal Int8,
Interactive Int8,
MachineName String: Nombre de la máquina donde ocurre la acción,
RemoteMachineName String: Nombre de la máquina remota en una conexión,
RemoteUsername String: Nombre del usuario loggeado en la máquina remota,
Protocol Int8,
IsIpv6 Int8,
RemoteIp String: IP remota en una comunicación o conexión,
RemotePort UInt16,
LocalIp String: IP local en una comunicación o conexión,
LocalPort UInt16,
Direction Int8,
DestinationIp String,
DestinationPort UInt16,
OpStatus Int8,
Ipv4Status Int8,
Redirection Int8,
Url String: URL desde donde se descargó un archivo,
Method UInt8,
HeaderHttp String,
RuleId LowCardinality(FixedString(36)),
IOAId String: Nombre descriptivo del IOA (Indicator of Attack),
IOATimeStamp DateTime('Etc/UTC'): Fecha y hora de detección del IOA o alerta,
IOATimeStampOLD String,
List String,
FailedQueries UInt32,
Times UInt64,
CommandLine String: Línea de comandos usada para ejecutar un proceso o tarea,
OpenTimeStamp DateTime64(9,
'Etc/UTC'),
AccessType Int32,
PeCreationSource Int8,
TotalResolutionTime Int32,
AnalysisTime UInt8,
OperationFlags UInt64,
Copy String,
BytesSent UInt64,
BytesReceived UInt64,
TotalRequest UInt32,
ReqDomainBytesMean UInt32,
ReqDomainNumberPercent UInt8,
ReqTransferRate UInt8,
ReqUncommonRRP Int8,
TotalResponse UInt32,
RespDomainBytesMean UInt32,
RespDomainNumberPercent UInt8,
RespTransferRate UInt8,
RespUncommonRRP Int8,
ALProtocolExpected UInt32,
ALProtocolDetected UInt32,
CipherType UInt16,
ConnectionState UInt8,
ProxyConnection Int8,
ContentEncoding UInt8,
LoggedUser String: Nombre del usuario loggeado durante la acción,
NotificationType Int32,
DeviceType UInt8: Tipo de dispositivo donde ocurre el evento,
ServerCount UInt8,
UniqueId String,
IsDenied Int8,
IdName String,
ClassName String: Nombre descriptivo relacionado con la clasificación del archivo hijo
	Ejemplos: {0:"Unknown",1:"Goodware",2:"Malware",3:"Suspect",4:"Compromised",5:"GWNotConfirmed",6:"Pup",7:"GwUnwanted",8:"GwRanked"},
FriendlyName String: Nombre descriptivo del tipo de dispositivo, relacionado con DeviceType,
Manufacturer String,
PhoneDescription String,
OverQuotaEventType LowCardinality(String),
Percentage UInt8,
Threshold UInt32,
Version Int8,
VersionController LowCardinality(String),
VersionAgent LowCardinality(String),
VersionDetectEvent LowCardinality(String),
VersionProduct LowCardinality(String),
AdvancedRulesConf LowCardinality(String),
VTableDetEvent LowCardinality(String),
VTableRamsomEvent LowCardinality(String),
VRamsomEvent LowCardinality(String),
VAntiExploit LowCardinality(String),
VTFilterAntiExploit LowCardinality(String),
VIOAPlg LowCardinality(String),
VTTPPlg LowCardinality(String),
VSherlockPlg LowCardinality(String),
ExploitOrigin UInt8,
WsDocs String,
SessionDate DateTime('Etc/UTC'),
Age DateTime('Etc/UTC'),
RegistryAction Int8,
Key String,
Value String,
ValueDataLength UInt16,
ValueData String,
Risk Int8],
 	
and given the following CONTEXT related with a cybersecurity incident currently under investigation: 
[AccountId='WGC-1-CCF8B486C6C147FE8D65',
 Muid='5C21ACD6DBC345A58ED61BF5DDB7880D',
 LoggedUser='EDR2W7X64\Administrator',
 AlertDateTime=2024-05-28,
 ChildFilename='virus.exe',
 ParentFilename='cmd.exe',
 CommandLine='C:\bateria\MV\Virus.exe',
 ParentPath='SYSTEM|\cmd.exe',
 ChildPath='SYSTEMDRIVE|\bateria\MV\Virus.exe']

and given the following INSTRUCTIONS for generating Clickhouse queries:
[return ONLY the query, no additional natural language words, explanations, or information;
ensure all field names match the provided schema exactly in terms of uppercase and lowercase characters;
display ONLY the minimum required fields in the output query, avoid using *;
when asked about a public IP, exclude private IP ranges;
print the queries in a SINGLE line;
apply SELECT DISTINCT by default (unless otherwise specified by the user);
when counting, use SELECT COUNT(DISTINCT fieldname) by default (unless otherwise specified by the user);
differentiate between Operation and EventType fields (e.g., for downloaded files, use EventType=14, not Operation=14);
include the Operation field when asked about execution, creation, deletion, etc.;
include the Muid field by default when asked about a Machine;
when asked about FILES, provide unique ChildMd5 or ParentMd5 instead of ChildFilename or ParentFilename  (unless otherwise specified by the user);
include always the Operation condition when asked about a certain action of a file;
return RemoteIp instead of DestinationIp when asked about which IPs a machine has connected to;
count distinct ChildPid or ParentPid by default when asked about how many Processes fulfill a certain condition;
return ParentFilename by default when asked where a process comes from;
return distinct ParentPid by default when asked about the parent process of another process;
return distinct ParentPid when asked about 'with how many PIDs has been executed a certain process name';
return distinct ChildPid when asked about 'how many PIDs has executed a certain process name';
return distinct ParentFilename by default when asked about the parent file of another process;
return ChildFilename or ParentFilename when asked about a process name;
IMPORTANT: specify ALWAYS the Operation and EventType conditions when asked about execution, creation or any other intercepted operations;
when asked about EXECUTION, always include EventType=1 and Operation=0 conditions;
return the DateTime field by default when asked about when something happened;
perform a count() to count all events when asked about "counting data accesses";
perform a count() to count all events when asked about "how many communications";
When asked about "public IPs" or "private IPs" note that the functions "isPublicIP, isPublicIPv4, isPrivateIP, isPrivateIPv4" do NOT exist in official clickhouse sintaxis. Encode query with LIKE or numeric ranges NOT using the mentioned functions;
apply a SUM operation when asked about "how many bytes";
consider DateTime instead of ChildFirstSeen when asked about the "first time a file has been seen";
consider Operation=9 instead of Operation=1 when asked about "compressed files creation";
consider Action=1 by default when asked about "blocked files or processes";
apply this condition for "remote execution in the machine": "prewhere EventType=1 and Operation=0 where bitAnd(ChildAttributes, 4096) != 0";
use the full 24 hours of start and end date when a time range between two dates is provided;
use the DateTime field instead of Date by default when processing dates as conditions;
count distinct ChildMd5 by default when counting files;
count () when counting total downloads, as events are being counted;
return toDate(DateTime) or Date field by default when asked about dates (e.g., which day...);
return results for the last 30 days by default if no time interval is specified;
always use Muid instead of MachineName;
show one result query per row;
count distinct unique ChildMd5 (or ParentMd5 if referring to parent files) by default when asked about how many files fulfill a certain condition, unless counting events, in which case count total rows);
when adding a DateTime range condition in the WHERE, apply DateTime>=X and DateTime<Y including always the > character to ensure the range is correct;
file execution should be checked with Operation=0 condition, not EventType=0;
when asked about unknown files, goodware ranked files, etc... consider ChildClassification field with it´s integer enum value, not ClassName field; 
when asked about how many processes have done something, count distinct ChildPid;
when asked about which users have done something, consider LoggedUser field instead of RemoteUsername;
when asked about the first time something happened, if you use ORDER BY MIN(DateTime) ensure the main fieldname is under aggregation function. ie: \"SELECT DISTINCT Muid FROM Telemetry WHERE ChildFilename='virus.exe' ORDER BY MIN(DateTime) LIMIT 1; \" = WRONG -> \"SELECT DISTINCT Muid,MIN(DateTime) FROM Telemetry WHERE ChildFilename='virus.exe' GROUP BY Muid ORDER BY MIN(DateTime) LIMIT 1;\" = CORRECT ;
When using a prewhere clause do NOT include a WHERE to ensure query works;
NEVER use isPrivateIP or isPublicIP functions, encode queries in a different manner;
When asked about a USB unit, apply ChildDrive=2 condition;
]

CREATE a runnable and working clickhouse query attending to the following user petitions and taking in consideration the CONTEXT provided:  user_querys = [
  "Cuántos ficheros comprimidos se han creado en la unidad de USB en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                             
  "Cuántas commandlines ha ejecutado el proceso llamado 'csrss.exe' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                        
  "Qué ancho de banda de salida ha consumido el proceso llamado tentacle_client.exe” en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                           
  "Cuántos directorios diferentes ha creado el proceso 'git.exe' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                 
  "Cuántos procesos han generado eventos de DNS fallidas en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                      
  "Qué procesos se han conectado con el host 'watson.microsoft.com' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                     
  "Qué IP corresponde al host 'watson.microsoft.com' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                    
  "Cuántos nombres de procesos ha ejecutado el usuario 'EDR2W7X64\Administrator' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                             
  "A qué hora se intenta ejecutar por primera vez el script llamado 'df.vbs’ en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                  
  "Con cuantos PID distintos se ejecuta el proceso 'searchindexer.exe' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                         
  "Cuántos PID distintos ejecuta el proceso 'searchindexer.exe' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                
  "Cuántas DLLs se han cargado en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                     
  "Qué procesos han accedido a datos en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                                      
  "A qué hora se ha cerrado la sesión remota que había abierta desde la máquina 'TURISME01' en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",               
  "Cuántos ficheros PE ha creado el proceso msiexec.exe que no sean desconocidos en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",
  "En cuántos procesos se ha inyectado un hilo remoto en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                          
  "Qué procesos han inyectado un hilo remoto en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                                
  "Ha habido alguna inyección de código en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                                   
  "Cuantas veces se ha ejecutado el proceso 'raserver.exe' contenido en el path del sistema de Windows en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",    
  "Cuantas veces se ha ejecutado el proceso grep contenido en el path /usr/bin/grep en la máquina 5C21ACD6DBC345A58ED61BF5DDB7880D del cliente WGC-1-CCF8B486C6C147FE8D65 el día 2024-05-28?",                                                                                                                                                                                 
 ]