Visit the Known Issues dashboard if you are experiencing issues on RSA Link
I figured this out. A statement with network.denied.connections OR network.connections has to be used.
What do you get if you leave out the watchlist from the where clause? Let's make sure that you get the data you expect and then we can look at the watchlist.
Revised question, see above.
I don't see your response.