Where do I find the macro "src_dest_tracker" listed in a Corr. search in ES to detect Spyware activity?

[SamHTexas]

This posting did not let me share the search string due to it containing HTML code etc. Any advice is appreciated. Thank u