query(group) indicators by domain name

[JoshBoyd]

If I have a tenant/account that has incidents.

some of those incidents have indicators / entities tied to abc.com or xyz.com

Is there a way to query for, show me all the incidents that have hostnames or account names that end in abc.com?

Wasn't having luck in xsoar, so i switched over to kibana and our elastic database, but I don't see any of my indicators stored in elastic; are indicators not stored in elastic DB?

Thanks in advance

[PC-TomS]

dataset = host_users_to_groups
| filter agent_domain = "abc.com"