I ended up finding a solution. Thought I'd share:
rt_idp (source_address=[ip range]) | top 100 source_address, destination_address, attack_name, threat_severity, source_zone_name, destination_zone_name | lookup dnsLookup ip as source_address | rename host as src_dns | mvcombine destination_address | eval dst_count=mvcount(destination_address) | eval sample_dst_addr=mvindex(destination_address,0) | lookup dnsLookup ip as sample_dst_addr | rename host as sample_dst_dns | sort threat_severity, source_address | table threat_severity, attack_name, source_address, src_dns, source_zone_name, destination_zone_name, dst_count, sample_dst_addr, sample_dst_dns
... View more