index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "forward-icloud.com" OR destinationhostname CONTAINS "acwa-internal.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "activecampaign-hr.com" OR destinationhostname CONTAINS "activecampainhr.com" OR destinationhostname CONTAINS "block-hr.com" OR destinationhostname CONTAINS "block-sso.com" OR destinationhostname CONTAINS "cashsso.com" OR destinationhostname CONTAINS "hr-gnc.com" OR destinationhostname CONTAINS "login.block-hr.com" OR destinationhostname CONTAINS "uscellular-sso.com" OR destinationhostname CONTAINS "sunrise-crypto.com" OR destinationhostname CONTAINS "expediagroup-servicenow.com" OR destinationhostname CONTAINS "adasupport-okta.com" OR destinationhostname CONTAINS "alchemy-okta.com" OR destinationhostname CONTAINS "auth-alchemy.com" OR destinationhostname CONTAINS "login.ally-hr.com" OR destinationhostname CONTAINS "login.corporate-ally.com" OR destinationhostname CONTAINS "amica-hr.com" OR destinationhostname CONTAINS "hanover-hr.com" OR destinationhostname CONTAINS "sharing-folders.com" OR destinationhostname CONTAINS "login.realogy-hr.com" OR destinationhostname CONTAINS "acwa-apple.com" OR destinationhostname CONTAINS "apple-vpn.com" OR destinationhostname CONTAINS "sync-apple.com" OR destinationhostname CONTAINS "okta-blockdaemon.com" OR destinationhostname CONTAINS "authenticate-bt.[com" OR destinationhostname CONTAINS "www.authenticate-bt.com" OR destinationhostname CONTAINS "cellularsaies.com" OR destinationhostname CONTAINS "okta. cellularsaies.com" OR destinationhostname CONTAINS "okta.cellularsaies.com" OR destinationhostname CONTAINS "clicksend-staging.com" OR destinationhostname CONTAINS "okta-cbhq.net" OR destinationhostname CONTAINS "commonspiritcorp-okta.com" OR destinationhostname CONTAINS "condenast-hub-okta-emea.com" OR destinationhostname CONTAINS "consensys-okta.com" OR destinationhostname CONTAINS "corescientific-okta.com" OR destinationhostname CONTAINS "settings-okta.com" OR destinationhostname CONTAINS "docusignhq.net" OR destinationhostname CONTAINS "docusign-okta.com" OR destinationhostname CONTAINS "account.kemper-support.com" OR destinationhostname CONTAINS "calendar-dd.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "www.dashsso.com" OR destinationhostname CONTAINS "epic-servicedesk.com" OR destinationhostname CONTAINS "sso-falconx.com" OR destinationhostname CONTAINS "fico-servicenow.com" OR destinationhostname CONTAINS "five9-hr.com" OR destinationhostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "forward-icloud.com" OR sourcentdomain CONTAINS "acwa-internal.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "activecampaign-hr.com" OR sourcentdomain CONTAINS "activecampainhr.com" OR sourcentdomain CONTAINS "block-hr.com" OR sourcentdomain CONTAINS "block-sso.com" OR sourcentdomain CONTAINS "cashsso.com" OR sourcentdomain CONTAINS "hr-gnc.com" OR sourcentdomain CONTAINS "login.block-hr.com" OR sourcentdomain CONTAINS "uscellular-sso.com" OR sourcentdomain CONTAINS "sunrise-crypto.com" OR sourcentdomain CONTAINS "expediagroup-servicenow.com" OR sourcentdomain CONTAINS "adasupport-okta.com" OR sourcentdomain CONTAINS "alchemy-okta.com" OR sourcentdomain CONTAINS "auth-alchemy.com" OR sourcentdomain CONTAINS "login.ally-hr.com" OR sourcentdomain CONTAINS "login.corporate-ally.com" OR sourcentdomain CONTAINS "amica-hr.com" OR sourcentdomain CONTAINS "hanover-hr.com" OR sourcentdomain CONTAINS "sharing-folders.com" OR sourcentdomain CONTAINS "login.realogy-hr.com" OR sourcentdomain CONTAINS "acwa-apple.com" OR sourcentdomain CONTAINS "apple-vpn.com" OR sourcentdomain CONTAINS "sync-apple.com" OR sourcentdomain CONTAINS "okta-blockdaemon.com" OR sourcentdomain CONTAINS "authenticate-bt.[com" OR sourcentdomain CONTAINS "www.authenticate-bt.com" OR sourcentdomain CONTAINS "cellularsaies.com" OR sourcentdomain CONTAINS "okta. cellularsaies.com" OR sourcentdomain CONTAINS "okta.cellularsaies.com" OR sourcentdomain CONTAINS "clicksend-staging.com" OR sourcentdomain CONTAINS "okta-cbhq.net" OR sourcentdomain CONTAINS "commonspiritcorp-okta.com" OR sourcentdomain CONTAINS "condenast-hub-okta-emea.com" OR sourcentdomain CONTAINS "consensys-okta.com" OR sourcentdomain CONTAINS "corescientific-okta.com" OR sourcentdomain CONTAINS "settings-okta.com" OR sourcentdomain CONTAINS "docusignhq.net" OR sourcentdomain CONTAINS "docusign-okta.com" OR sourcentdomain CONTAINS "account.kemper-support.com" OR sourcentdomain CONTAINS "calendar-dd.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "www.dashsso.com" OR sourcentdomain CONTAINS "epic-servicedesk.com" OR sourcentdomain CONTAINS "sso-falconx.com" OR sourcentdomain CONTAINS "fico-servicenow.com" OR sourcentdomain CONTAINS "five9-hr.com" OR sourcentdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "forward-icloud.com" OR sourcehostname CONTAINS "acwa-internal.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "activecampaign-hr.com" OR sourcehostname CONTAINS "activecampainhr.com" OR sourcehostname CONTAINS "block-hr.com" OR sourcehostname CONTAINS "block-sso.com" OR sourcehostname CONTAINS "cashsso.com" OR sourcehostname CONTAINS "hr-gnc.com" OR sourcehostname CONTAINS "login.block-hr.com" OR sourcehostname CONTAINS "uscellular-sso.com" OR sourcehostname CONTAINS "sunrise-crypto.com" OR sourcehostname CONTAINS "expediagroup-servicenow.com" OR sourcehostname CONTAINS "adasupport-okta.com" OR sourcehostname CONTAINS "alchemy-okta.com" OR sourcehostname CONTAINS "auth-alchemy.com" OR sourcehostname CONTAINS "login.ally-hr.com" OR sourcehostname CONTAINS "login.corporate-ally.com" OR sourcehostname CONTAINS "amica-hr.com" OR sourcehostname CONTAINS "hanover-hr.com" OR sourcehostname CONTAINS "sharing-folders.com" OR sourcehostname CONTAINS "login.realogy-hr.com" OR sourcehostname CONTAINS "acwa-apple.com" OR sourcehostname CONTAINS "apple-vpn.com" OR sourcehostname CONTAINS "sync-apple.com" OR sourcehostname CONTAINS "okta-blockdaemon.com" OR sourcehostname CONTAINS "authenticate-bt.[com" OR sourcehostname CONTAINS "www.authenticate-bt.com" OR sourcehostname CONTAINS "cellularsaies.com" OR sourcehostname CONTAINS "okta. cellularsaies.com" OR sourcehostname CONTAINS "okta.cellularsaies.com" OR sourcehostname CONTAINS "clicksend-staging.com" OR sourcehostname CONTAINS "okta-cbhq.net" OR sourcehostname CONTAINS "commonspiritcorp-okta.com" OR sourcehostname CONTAINS "condenast-hub-okta-emea.com" OR sourcehostname CONTAINS "consensys-okta.com" OR sourcehostname CONTAINS "corescientific-okta.com" OR sourcehostname CONTAINS "settings-okta.com" OR sourcehostname CONTAINS "docusignhq.net" OR sourcehostname CONTAINS "docusign-okta.com" OR sourcehostname CONTAINS "account.kemper-support.com" OR sourcehostname CONTAINS "calendar-dd.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "www.dashsso.com" OR sourcehostname CONTAINS "epic-servicedesk.com" OR sourcehostname CONTAINS "sso-falconx.com" OR sourcehostname CONTAINS "fico-servicenow.com" OR sourcehostname CONTAINS "five9-hr.com" OR sourcehostname CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "forward-icloud.com" OR destinationntdomain CONTAINS "acwa-internal.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "activecampaign-hr.com" OR destinationntdomain CONTAINS "activecampainhr.com" OR destinationntdomain CONTAINS "block-hr.com" OR destinationntdomain CONTAINS "block-sso.com" OR destinationntdomain CONTAINS "cashsso.com" OR destinationntdomain CONTAINS "hr-gnc.com" OR destinationntdomain CONTAINS "login.block-hr.com" OR destinationntdomain CONTAINS "uscellular-sso.com" OR destinationntdomain CONTAINS "sunrise-crypto.com" OR destinationntdomain CONTAINS "expediagroup-servicenow.com" OR destinationntdomain CONTAINS "adasupport-okta.com" OR destinationntdomain CONTAINS "alchemy-okta.com" OR destinationntdomain CONTAINS "auth-alchemy.com" OR destinationntdomain CONTAINS "login.ally-hr.com" OR destinationntdomain CONTAINS "login.corporate-ally.com" OR destinationntdomain CONTAINS "amica-hr.com" OR destinationntdomain CONTAINS "hanover-hr.com" OR destinationntdomain CONTAINS "sharing-folders.com" OR destinationntdomain CONTAINS "login.realogy-hr.com" OR destinationntdomain CONTAINS "acwa-apple.com" OR destinationntdomain CONTAINS "apple-vpn.com" OR destinationntdomain CONTAINS "sync-apple.com" OR destinationntdomain CONTAINS "okta-blockdaemon.com" OR destinationntdomain CONTAINS "authenticate-bt.[com" OR destinationntdomain CONTAINS "www.authenticate-bt.com" OR destinationntdomain CONTAINS "cellularsaies.com" OR destinationntdomain CONTAINS "okta. cellularsaies.com" OR destinationntdomain CONTAINS "okta.cellularsaies.com" OR destinationntdomain CONTAINS "clicksend-staging.com" OR destinationntdomain CONTAINS "okta-cbhq.net" OR destinationntdomain CONTAINS "commonspiritcorp-okta.com" OR destinationntdomain CONTAINS "condenast-hub-okta-emea.com" OR destinationntdomain CONTAINS "consensys-okta.com" OR destinationntdomain CONTAINS "corescientific-okta.com" OR destinationntdomain CONTAINS "settings-okta.com" OR destinationntdomain CONTAINS "docusignhq.net" OR destinationntdomain CONTAINS "docusign-okta.com" OR destinationntdomain CONTAINS "account.kemper-support.com" OR destinationntdomain CONTAINS "calendar-dd.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "www.dashsso.com" OR destinationntdomain CONTAINS "epic-servicedesk.com" OR destinationntdomain CONTAINS "sso-falconx.com" OR destinationntdomain CONTAINS "fico-servicenow.com" OR destinationntdomain CONTAINS "five9-hr.com" OR destinationntdomain CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "forward-icloud.com" OR requesturl CONTAINS "acwa-internal.com" OR requesturl CONTAINS "twitter-okta.com" OR requesturl CONTAINS "activecampaign-hr.com" OR requesturl CONTAINS "activecampainhr.com" OR requesturl CONTAINS "block-hr.com" OR requesturl CONTAINS "block-sso.com" OR requesturl CONTAINS "cashsso.com" OR requesturl CONTAINS "hr-gnc.com" OR requesturl CONTAINS "login.block-hr.com" OR requesturl CONTAINS "uscellular-sso.com" OR requesturl CONTAINS "sunrise-crypto.com" OR requesturl CONTAINS "expediagroup-servicenow.com" OR requesturl CONTAINS "adasupport-okta.com" OR requesturl CONTAINS "alchemy-okta.com" OR requesturl CONTAINS "auth-alchemy.com" OR requesturl CONTAINS "login.ally-hr.com" OR requesturl CONTAINS "login.corporate-ally.com" OR requesturl CONTAINS "amica-hr.com" OR requesturl CONTAINS "hanover-hr.com" OR requesturl CONTAINS "sharing-folders.com" OR requesturl CONTAINS "login.realogy-hr.com" OR requesturl CONTAINS "acwa-apple.com" OR requesturl CONTAINS "apple-vpn.com" OR requesturl CONTAINS "sync-apple.com" OR requesturl CONTAINS "okta-blockdaemon.com" OR requesturl CONTAINS "authenticate-bt.[com" OR requesturl CONTAINS "www.authenticate-bt.com" OR requesturl CONTAINS "cellularsaies.com" OR requesturl CONTAINS "okta. cellularsaies.com" OR requesturl CONTAINS "okta.cellularsaies.com" OR requesturl CONTAINS "clicksend-staging.com" OR requesturl CONTAINS "okta-cbhq.net" OR requesturl CONTAINS "commonspiritcorp-okta.com" OR requesturl CONTAINS "condenast-hub-okta-emea.com" OR requesturl CONTAINS "consensys-okta.com" OR requesturl CONTAINS "corescientific-okta.com" OR requesturl CONTAINS "settings-okta.com" OR requesturl CONTAINS "docusignhq.net" OR requesturl CONTAINS "docusign-okta.com" OR requesturl CONTAINS "account.kemper-support.com" OR requesturl CONTAINS "calendar-dd.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "www.dashsso.com" OR requesturl CONTAINS "epic-servicedesk.com" OR requesturl CONTAINS "sso-falconx.com" OR requesturl CONTAINS "fico-servicenow.com" OR requesturl CONTAINS "five9-hr.com" OR requesturl CONTAINS "login.five9-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "corp-foundever.com" OR destinationhostname CONTAINS "corp-foundever.net" OR destinationhostname CONTAINS "foundever-sso.com" OR destinationhostname CONTAINS "galaxy-okta.com" OR destinationhostname CONTAINS "okta-gamestop.com" OR destinationhostname CONTAINS "gemini-sso.com" OR destinationhostname CONTAINS "prntsrc.net" OR destinationhostname CONTAINS "stargate-sso.com" OR destinationhostname CONTAINS "stargatesso-gemini.com" OR destinationhostname CONTAINS "binance-us-okta.com" OR destinationhostname CONTAINS "gofundme-okta.com" OR destinationhostname CONTAINS "grayscale-okta.com" OR destinationhostname CONTAINS "grubhubsso.com" OR destinationhostname CONTAINS "grubhub-support.com" OR destinationhostname CONTAINS "login.grubhub-support.com" OR destinationhostname CONTAINS "corporate-huntington.com" OR destinationhostname CONTAINS "sso.ibexgiobal.com" OR destinationhostname CONTAINS "intercom-hr.com" OR destinationhostname CONTAINS "intercom-okta.com" OR destinationhostname CONTAINS "intercomsso.net" OR destinationhostname CONTAINS "login.hr-intercom.com" OR destinationhostname CONTAINS "okta-intercom.com" OR destinationhostname CONTAINS "itbit-okta.com" OR destinationhostname CONTAINS "jacksonhewitt-service.com" OR destinationhostname CONTAINS "account.klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyocorp.net" OR destinationhostname CONTAINS "klaviyo-hr.com" OR destinationhostname CONTAINS "klaviyo-vpn.com" OR destinationhostname CONTAINS "klav-workday.com" OR destinationhostname CONTAINS "login.klaviyo-hr.com" OR destinationhostname CONTAINS "sso-klaviyo.com" OR destinationhostname CONTAINS "louisvuitton-okta.com" OR destinationhostname CONTAINS "luno-okta.com" OR destinationhostname CONTAINS "dashboard-mailgun.com" OR destinationhostname CONTAINS "review-mailgun.com" OR destinationhostname CONTAINS "verify-mailgun.com" OR destinationhostname CONTAINS "okta-campaignmonitor.com" OR destinationhostname CONTAINS "markel-hr.com" OR destinationhostname CONTAINS "mgmresorts-okta.com" OR destinationhostname CONTAINS "newyorklifehr.com" OR destinationhostname CONTAINS "login.nfp-hr.com" OR destinationhostname CONTAINS "nfp-hr.com" OR destinationhostname CONTAINS "nike-support.com" OR destinationhostname CONTAINS "okta-nydig.com" OR destinationhostname CONTAINS "okta-onsolve.com" OR destinationhostname CONTAINS "onsolve-okta.com" OR destinationhostname CONTAINS "paxos-okta.com" OR destinationhostname CONTAINS "login.corporate-pnc.com" OR destinationhostname CONTAINS "cinfin-hr.com" OR destinationhostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "corp-foundever.com" OR sourcentdomain CONTAINS "corp-foundever.net" OR sourcentdomain CONTAINS "foundever-sso.com" OR sourcentdomain CONTAINS "galaxy-okta.com" OR sourcentdomain CONTAINS "okta-gamestop.com" OR sourcentdomain CONTAINS "gemini-sso.com" OR sourcentdomain CONTAINS "prntsrc.net" OR sourcentdomain CONTAINS "stargate-sso.com" OR sourcentdomain CONTAINS "stargatesso-gemini.com" OR sourcentdomain CONTAINS "binance-us-okta.com" OR sourcentdomain CONTAINS "gofundme-okta.com" OR sourcentdomain CONTAINS "grayscale-okta.com" OR sourcentdomain CONTAINS "grubhubsso.com" OR sourcentdomain CONTAINS "grubhub-support.com" OR sourcentdomain CONTAINS "login.grubhub-support.com" OR sourcentdomain CONTAINS "corporate-huntington.com" OR sourcentdomain CONTAINS "sso.ibexgiobal.com" OR sourcentdomain CONTAINS "intercom-hr.com" OR sourcentdomain CONTAINS "intercom-okta.com" OR sourcentdomain CONTAINS "intercomsso.net" OR sourcentdomain CONTAINS "login.hr-intercom.com" OR sourcentdomain CONTAINS "okta-intercom.com" OR sourcentdomain CONTAINS "itbit-okta.com" OR sourcentdomain CONTAINS "jacksonhewitt-service.com" OR sourcentdomain CONTAINS "account.klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyocorp.net" OR sourcentdomain CONTAINS "klaviyo-hr.com" OR sourcentdomain CONTAINS "klaviyo-vpn.com" OR sourcentdomain CONTAINS "klav-workday.com" OR sourcentdomain CONTAINS "login.klaviyo-hr.com" OR sourcentdomain CONTAINS "sso-klaviyo.com" OR sourcentdomain CONTAINS "louisvuitton-okta.com" OR sourcentdomain CONTAINS "luno-okta.com" OR sourcentdomain CONTAINS "dashboard-mailgun.com" OR sourcentdomain CONTAINS "review-mailgun.com" OR sourcentdomain CONTAINS "verify-mailgun.com" OR sourcentdomain CONTAINS "okta-campaignmonitor.com" OR sourcentdomain CONTAINS "markel-hr.com" OR sourcentdomain CONTAINS "mgmresorts-okta.com" OR sourcentdomain CONTAINS "newyorklifehr.com" OR sourcentdomain CONTAINS "login.nfp-hr.com" OR sourcentdomain CONTAINS "nfp-hr.com" OR sourcentdomain CONTAINS "nike-support.com" OR sourcentdomain CONTAINS "okta-nydig.com" OR sourcentdomain CONTAINS "okta-onsolve.com" OR sourcentdomain CONTAINS "onsolve-okta.com" OR sourcentdomain CONTAINS "paxos-okta.com" OR sourcentdomain CONTAINS "login.corporate-pnc.com" OR sourcentdomain CONTAINS "cinfin-hr.com" OR sourcentdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "corp-foundever.com" OR sourcehostname CONTAINS "corp-foundever.net" OR sourcehostname CONTAINS "foundever-sso.com" OR sourcehostname CONTAINS "galaxy-okta.com" OR sourcehostname CONTAINS "okta-gamestop.com" OR sourcehostname CONTAINS "gemini-sso.com" OR sourcehostname CONTAINS "prntsrc.net" OR sourcehostname CONTAINS "stargate-sso.com" OR sourcehostname CONTAINS "stargatesso-gemini.com" OR sourcehostname CONTAINS "binance-us-okta.com" OR sourcehostname CONTAINS "gofundme-okta.com" OR sourcehostname CONTAINS "grayscale-okta.com" OR sourcehostname CONTAINS "grubhubsso.com" OR sourcehostname CONTAINS "grubhub-support.com" OR sourcehostname CONTAINS "login.grubhub-support.com" OR sourcehostname CONTAINS "corporate-huntington.com" OR sourcehostname CONTAINS "sso.ibexgiobal.com" OR sourcehostname CONTAINS "intercom-hr.com" OR sourcehostname CONTAINS "intercom-okta.com" OR sourcehostname CONTAINS "intercomsso.net" OR sourcehostname CONTAINS "login.hr-intercom.com" OR sourcehostname CONTAINS "okta-intercom.com" OR sourcehostname CONTAINS "itbit-okta.com" OR sourcehostname CONTAINS "jacksonhewitt-service.com" OR sourcehostname CONTAINS "account.klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyocorp.net" OR sourcehostname CONTAINS "klaviyo-hr.com" OR sourcehostname CONTAINS "klaviyo-vpn.com" OR sourcehostname CONTAINS "klav-workday.com" OR sourcehostname CONTAINS "login.klaviyo-hr.com" OR sourcehostname CONTAINS "sso-klaviyo.com" OR sourcehostname CONTAINS "louisvuitton-okta.com" OR sourcehostname CONTAINS "luno-okta.com" OR sourcehostname CONTAINS "dashboard-mailgun.com" OR sourcehostname CONTAINS "review-mailgun.com" OR sourcehostname CONTAINS "verify-mailgun.com" OR sourcehostname CONTAINS "okta-campaignmonitor.com" OR sourcehostname CONTAINS "markel-hr.com" OR sourcehostname CONTAINS "mgmresorts-okta.com" OR sourcehostname CONTAINS "newyorklifehr.com" OR sourcehostname CONTAINS "login.nfp-hr.com" OR sourcehostname CONTAINS "nfp-hr.com" OR sourcehostname CONTAINS "nike-support.com" OR sourcehostname CONTAINS "okta-nydig.com" OR sourcehostname CONTAINS "okta-onsolve.com" OR sourcehostname CONTAINS "onsolve-okta.com" OR sourcehostname CONTAINS "paxos-okta.com" OR sourcehostname CONTAINS "login.corporate-pnc.com" OR sourcehostname CONTAINS "cinfin-hr.com" OR sourcehostname CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "corp-foundever.com" OR destinationntdomain CONTAINS "corp-foundever.net" OR destinationntdomain CONTAINS "foundever-sso.com" OR destinationntdomain CONTAINS "galaxy-okta.com" OR destinationntdomain CONTAINS "okta-gamestop.com" OR destinationntdomain CONTAINS "gemini-sso.com" OR destinationntdomain CONTAINS "prntsrc.net" OR destinationntdomain CONTAINS "stargate-sso.com" OR destinationntdomain CONTAINS "stargatesso-gemini.com" OR destinationntdomain CONTAINS "binance-us-okta.com" OR destinationntdomain CONTAINS "gofundme-okta.com" OR destinationntdomain CONTAINS "grayscale-okta.com" OR destinationntdomain CONTAINS "grubhubsso.com" OR destinationntdomain CONTAINS "grubhub-support.com" OR destinationntdomain CONTAINS "login.grubhub-support.com" OR destinationntdomain CONTAINS "corporate-huntington.com" OR destinationntdomain CONTAINS "sso.ibexgiobal.com" OR destinationntdomain CONTAINS "intercom-hr.com" OR destinationntdomain CONTAINS "intercom-okta.com" OR destinationntdomain CONTAINS "intercomsso.net" OR destinationntdomain CONTAINS "login.hr-intercom.com" OR destinationntdomain CONTAINS "okta-intercom.com" OR destinationntdomain CONTAINS "itbit-okta.com" OR destinationntdomain CONTAINS "jacksonhewitt-service.com" OR destinationntdomain CONTAINS "account.klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyocorp.net" OR destinationntdomain CONTAINS "klaviyo-hr.com" OR destinationntdomain CONTAINS "klaviyo-vpn.com" OR destinationntdomain CONTAINS "klav-workday.com" OR destinationntdomain CONTAINS "login.klaviyo-hr.com" OR destinationntdomain CONTAINS "sso-klaviyo.com" OR destinationntdomain CONTAINS "louisvuitton-okta.com" OR destinationntdomain CONTAINS "luno-okta.com" OR destinationntdomain CONTAINS "dashboard-mailgun.com" OR destinationntdomain CONTAINS "review-mailgun.com" OR destinationntdomain CONTAINS "verify-mailgun.com" OR destinationntdomain CONTAINS "okta-campaignmonitor.com" OR destinationntdomain CONTAINS "markel-hr.com" OR destinationntdomain CONTAINS "mgmresorts-okta.com" OR destinationntdomain CONTAINS "newyorklifehr.com" OR destinationntdomain CONTAINS "login.nfp-hr.com" OR destinationntdomain CONTAINS "nfp-hr.com" OR destinationntdomain CONTAINS "nike-support.com" OR destinationntdomain CONTAINS "okta-nydig.com" OR destinationntdomain CONTAINS "okta-onsolve.com" OR destinationntdomain CONTAINS "onsolve-okta.com" OR destinationntdomain CONTAINS "paxos-okta.com" OR destinationntdomain CONTAINS "login.corporate-pnc.com" OR destinationntdomain CONTAINS "cinfin-hr.com" OR destinationntdomain CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "corp-foundever.com" OR requesturl CONTAINS "corp-foundever.net" OR requesturl CONTAINS "foundever-sso.com" OR requesturl CONTAINS "galaxy-okta.com" OR requesturl CONTAINS "okta-gamestop.com" OR requesturl CONTAINS "gemini-sso.com" OR requesturl CONTAINS "prntsrc.net" OR requesturl CONTAINS "stargate-sso.com" OR requesturl CONTAINS "stargatesso-gemini.com" OR requesturl CONTAINS "binance-us-okta.com" OR requesturl CONTAINS "gofundme-okta.com" OR requesturl CONTAINS "grayscale-okta.com" OR requesturl CONTAINS "grubhubsso.com" OR requesturl CONTAINS "grubhub-support.com" OR requesturl CONTAINS "login.grubhub-support.com" OR requesturl CONTAINS "corporate-huntington.com" OR requesturl CONTAINS "sso.ibexgiobal.com" OR requesturl CONTAINS "intercom-hr.com" OR requesturl CONTAINS "intercom-okta.com" OR requesturl CONTAINS "intercomsso.net" OR requesturl CONTAINS "login.hr-intercom.com" OR requesturl CONTAINS "okta-intercom.com" OR requesturl CONTAINS "itbit-okta.com" OR requesturl CONTAINS "jacksonhewitt-service.com" OR requesturl CONTAINS "account.klaviyo-hr.com" OR requesturl CONTAINS "klaviyocorp.net" OR requesturl CONTAINS "klaviyo-hr.com" OR requesturl CONTAINS "klaviyo-vpn.com" OR requesturl CONTAINS "klav-workday.com" OR requesturl CONTAINS "login.klaviyo-hr.com" OR requesturl CONTAINS "sso-klaviyo.com" OR requesturl CONTAINS "louisvuitton-okta.com" OR requesturl CONTAINS "luno-okta.com" OR requesturl CONTAINS "dashboard-mailgun.com" OR requesturl CONTAINS "review-mailgun.com" OR requesturl CONTAINS "verify-mailgun.com" OR requesturl CONTAINS "okta-campaignmonitor.com" OR requesturl CONTAINS "markel-hr.com" OR requesturl CONTAINS "mgmresorts-okta.com" OR requesturl CONTAINS "newyorklifehr.com" OR requesturl CONTAINS "login.nfp-hr.com" OR requesturl CONTAINS "nfp-hr.com" OR requesturl CONTAINS "nike-support.com" OR requesturl CONTAINS "okta-nydig.com" OR requesturl CONTAINS "okta-onsolve.com" OR requesturl CONTAINS "onsolve-okta.com" OR requesturl CONTAINS "paxos-okta.com" OR requesturl CONTAINS "login.corporate-pnc.com" OR requesturl CONTAINS "cinfin-hr.com" OR requesturl CONTAINS "mercury-hr.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mutualofomaha-hr.com" OR destinationhostname CONTAINS "podium-hr.com" OR destinationhostname CONTAINS "revolut-ticket.com" OR destinationhostname CONTAINS "okta-ripple.com" OR destinationhostname CONTAINS "ripple-okta.com" OR destinationhostname CONTAINS "login.rbx-hr.com" OR destinationhostname CONTAINS "rbx.okta.bio" OR destinationhostname CONTAINS "rbx-corp.com" OR destinationhostname CONTAINS "rbx-hr.com" OR destinationhostname CONTAINS "rbxhr.net" OR destinationhostname CONTAINS "rbx-servicedesk.com" OR destinationhostname CONTAINS "roblox-hrs.com" OR destinationhostname CONTAINS "account.securian-hr.com" OR destinationhostname CONTAINS "login.securian-hr.com" OR destinationhostname CONTAINS "securian-hr.com" OR destinationhostname CONTAINS "contact-sendgrid.com" OR destinationhostname CONTAINS "manageactivity-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-account.com" OR destinationhostname CONTAINS "sessions-sendgrid.com" OR destinationhostname CONTAINS "grid-review.com" OR destinationhostname CONTAINS "account-sendgrid.com" OR destinationhostname CONTAINS "sendgrid-overview.com" OR destinationhostname CONTAINS "twillio-sendgrid.com" OR destinationhostname CONTAINS "rejectauth-sendgrid.com" OR destinationhostname CONTAINS "servicenowprod.com" OR destinationhostname CONTAINS "resolveservicedesk.com" OR destinationhostname CONTAINS "snapchat-okta.com" OR destinationhostname CONTAINS "squarespacehr.com" OR destinationhostname CONTAINS "squarespace-okta.com" OR destinationhostname CONTAINS "squarespace-hr.com" OR destinationhostname CONTAINS "login.suniife.com" OR destinationhostname CONTAINS "login.synchronyfinanciai.com" OR destinationhostname CONTAINS "ping.taskus-sso.com" OR destinationhostname CONTAINS "teleperformance-incident.com" OR destinationhostname CONTAINS "telesignhr.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "telint-helpdesk.com" OR destinationhostname CONTAINS "login.thrivent-hr.com" OR destinationhostname CONTAINS "thrivent-hr.com" OR destinationhostname CONTAINS "corp-cox.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "verify-tmobile.com" OR destinationhostname CONTAINS "storewatch-tmobile.com" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "ally-hr.com" OR destinationhostname CONTAINS "corporate-ally.com" OR destinationhostname CONTAINS "transamerica-hr.com" OR destinationhostname CONTAINS "login.transamerica-hr.com" OR destinationhostname CONTAINS "okta-twilio.com" OR destinationhostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mutualofomaha-hr.com" OR sourcentdomain CONTAINS "podium-hr.com" OR sourcentdomain CONTAINS "revolut-ticket.com" OR sourcentdomain CONTAINS "okta-ripple.com" OR sourcentdomain CONTAINS "ripple-okta.com" OR sourcentdomain CONTAINS "login.rbx-hr.com" OR sourcentdomain CONTAINS "rbx.okta.bio" OR sourcentdomain CONTAINS "rbx-corp.com" OR sourcentdomain CONTAINS "rbx-hr.com" OR sourcentdomain CONTAINS "rbxhr.net" OR sourcentdomain CONTAINS "rbx-servicedesk.com" OR sourcentdomain CONTAINS "roblox-hrs.com" OR sourcentdomain CONTAINS "account.securian-hr.com" OR sourcentdomain CONTAINS "login.securian-hr.com" OR sourcentdomain CONTAINS "securian-hr.com" OR sourcentdomain CONTAINS "contact-sendgrid.com" OR sourcentdomain CONTAINS "manageactivity-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-account.com" OR sourcentdomain CONTAINS "sessions-sendgrid.com" OR sourcentdomain CONTAINS "grid-review.com" OR sourcentdomain CONTAINS "account-sendgrid.com" OR sourcentdomain CONTAINS "sendgrid-overview.com" OR sourcentdomain CONTAINS "twillio-sendgrid.com" OR sourcentdomain CONTAINS "rejectauth-sendgrid.com" OR sourcentdomain CONTAINS "servicenowprod.com" OR sourcentdomain CONTAINS "resolveservicedesk.com" OR sourcentdomain CONTAINS "snapchat-okta.com" OR sourcentdomain CONTAINS "squarespacehr.com" OR sourcentdomain CONTAINS "squarespace-okta.com" OR sourcentdomain CONTAINS "squarespace-hr.com" OR sourcentdomain CONTAINS "login.suniife.com" OR sourcentdomain CONTAINS "login.synchronyfinanciai.com" OR sourcentdomain CONTAINS "ping.taskus-sso.com" OR sourcentdomain CONTAINS "teleperformance-incident.com" OR sourcentdomain CONTAINS "telesignhr.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "telint-helpdesk.com" OR sourcentdomain CONTAINS "login.thrivent-hr.com" OR sourcentdomain CONTAINS "thrivent-hr.com" OR sourcentdomain CONTAINS "corp-cox.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "verify-tmobile.com" OR sourcentdomain CONTAINS "storewatch-tmobile.com" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "ally-hr.com" OR sourcentdomain CONTAINS "corporate-ally.com" OR sourcentdomain CONTAINS "transamerica-hr.com" OR sourcentdomain CONTAINS "login.transamerica-hr.com" OR sourcentdomain CONTAINS "okta-twilio.com" OR sourcentdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mutualofomaha-hr.com" OR sourcehostname CONTAINS "podium-hr.com" OR sourcehostname CONTAINS "revolut-ticket.com" OR sourcehostname CONTAINS "okta-ripple.com" OR sourcehostname CONTAINS "ripple-okta.com" OR sourcehostname CONTAINS "login.rbx-hr.com" OR sourcehostname CONTAINS "rbx.okta.bio" OR sourcehostname CONTAINS "rbx-corp.com" OR sourcehostname CONTAINS "rbx-hr.com" OR sourcehostname CONTAINS "rbxhr.net" OR sourcehostname CONTAINS "rbx-servicedesk.com" OR sourcehostname CONTAINS "roblox-hrs.com" OR sourcehostname CONTAINS "account.securian-hr.com" OR sourcehostname CONTAINS "login.securian-hr.com" OR sourcehostname CONTAINS "securian-hr.com" OR sourcehostname CONTAINS "contact-sendgrid.com" OR sourcehostname CONTAINS "manageactivity-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-account.com" OR sourcehostname CONTAINS "sessions-sendgrid.com" OR sourcehostname CONTAINS "grid-review.com" OR sourcehostname CONTAINS "account-sendgrid.com" OR sourcehostname CONTAINS "sendgrid-overview.com" OR sourcehostname CONTAINS "twillio-sendgrid.com" OR sourcehostname CONTAINS "rejectauth-sendgrid.com" OR sourcehostname CONTAINS "servicenowprod.com" OR sourcehostname CONTAINS "resolveservicedesk.com" OR sourcehostname CONTAINS "snapchat-okta.com" OR sourcehostname CONTAINS "squarespacehr.com" OR sourcehostname CONTAINS "squarespace-okta.com" OR sourcehostname CONTAINS "squarespace-hr.com" OR sourcehostname CONTAINS "login.suniife.com" OR sourcehostname CONTAINS "login.synchronyfinanciai.com" OR sourcehostname CONTAINS "ping.taskus-sso.com" OR sourcehostname CONTAINS "teleperformance-incident.com" OR sourcehostname CONTAINS "telesignhr.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "telint-helpdesk.com" OR sourcehostname CONTAINS "login.thrivent-hr.com" OR sourcehostname CONTAINS "thrivent-hr.com" OR sourcehostname CONTAINS "corp-cox.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "verify-tmobile.com" OR sourcehostname CONTAINS "storewatch-tmobile.com" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "ally-hr.com" OR sourcehostname CONTAINS "corporate-ally.com" OR sourcehostname CONTAINS "transamerica-hr.com" OR sourcehostname CONTAINS "login.transamerica-hr.com" OR sourcehostname CONTAINS "okta-twilio.com" OR sourcehostname CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mutualofomaha-hr.com" OR destinationntdomain CONTAINS "podium-hr.com" OR destinationntdomain CONTAINS "revolut-ticket.com" OR destinationntdomain CONTAINS "okta-ripple.com" OR destinationntdomain CONTAINS "ripple-okta.com" OR destinationntdomain CONTAINS "login.rbx-hr.com" OR destinationntdomain CONTAINS "rbx.okta.bio" OR destinationntdomain CONTAINS "rbx-corp.com" OR destinationntdomain CONTAINS "rbx-hr.com" OR destinationntdomain CONTAINS "rbxhr.net" OR destinationntdomain CONTAINS "rbx-servicedesk.com" OR destinationntdomain CONTAINS "roblox-hrs.com" OR destinationntdomain CONTAINS "account.securian-hr.com" OR destinationntdomain CONTAINS "login.securian-hr.com" OR destinationntdomain CONTAINS "securian-hr.com" OR destinationntdomain CONTAINS "contact-sendgrid.com" OR destinationntdomain CONTAINS "manageactivity-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-account.com" OR destinationntdomain CONTAINS "sessions-sendgrid.com" OR destinationntdomain CONTAINS "grid-review.com" OR destinationntdomain CONTAINS "account-sendgrid.com" OR destinationntdomain CONTAINS "sendgrid-overview.com" OR destinationntdomain CONTAINS "twillio-sendgrid.com" OR destinationntdomain CONTAINS "rejectauth-sendgrid.com" OR destinationntdomain CONTAINS "servicenowprod.com" OR destinationntdomain CONTAINS "resolveservicedesk.com" OR destinationntdomain CONTAINS "snapchat-okta.com" OR destinationntdomain CONTAINS "squarespacehr.com" OR destinationntdomain CONTAINS "squarespace-okta.com" OR destinationntdomain CONTAINS "squarespace-hr.com" OR destinationntdomain CONTAINS "login.suniife.com" OR destinationntdomain CONTAINS "login.synchronyfinanciai.com" OR destinationntdomain CONTAINS "ping.taskus-sso.com" OR destinationntdomain CONTAINS "teleperformance-incident.com" OR destinationntdomain CONTAINS "telesignhr.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "telint-helpdesk.com" OR destinationntdomain CONTAINS "login.thrivent-hr.com" OR destinationntdomain CONTAINS "thrivent-hr.com" OR destinationntdomain CONTAINS "corp-cox.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "verify-tmobile.com" OR destinationntdomain CONTAINS "storewatch-tmobile.com" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "ally-hr.com" OR destinationntdomain CONTAINS "corporate-ally.com" OR destinationntdomain CONTAINS "transamerica-hr.com" OR destinationntdomain CONTAINS "login.transamerica-hr.com" OR destinationntdomain CONTAINS "okta-twilio.com" OR destinationntdomain CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "mutualofomaha-hr.com" OR requesturl CONTAINS "podium-hr.com" OR requesturl CONTAINS "revolut-ticket.com" OR requesturl CONTAINS "okta-ripple.com" OR requesturl CONTAINS "ripple-okta.com" OR requesturl CONTAINS "login.rbx-hr.com" OR requesturl CONTAINS "rbx.okta.bio" OR requesturl CONTAINS "rbx-corp.com" OR requesturl CONTAINS "rbx-hr.com" OR requesturl CONTAINS "rbxhr.net" OR requesturl CONTAINS "rbx-servicedesk.com" OR requesturl CONTAINS "roblox-hrs.com" OR requesturl CONTAINS "account.securian-hr.com" OR requesturl CONTAINS "login.securian-hr.com" OR requesturl CONTAINS "securian-hr.com" OR requesturl CONTAINS "contact-sendgrid.com" OR requesturl CONTAINS "manageactivity-sendgrid.com" OR requesturl CONTAINS "sendgrid-account.com" OR requesturl CONTAINS "sessions-sendgrid.com" OR requesturl CONTAINS "grid-review.com" OR requesturl CONTAINS "account-sendgrid.com" OR requesturl CONTAINS "sendgrid-overview.com" OR requesturl CONTAINS "twillio-sendgrid.com" OR requesturl CONTAINS "rejectauth-sendgrid.com" OR requesturl CONTAINS "servicenowprod.com" OR requesturl CONTAINS "resolveservicedesk.com" OR requesturl CONTAINS "snapchat-okta.com" OR requesturl CONTAINS "squarespacehr.com" OR requesturl CONTAINS "squarespace-okta.com" OR requesturl CONTAINS "squarespace-hr.com" OR requesturl CONTAINS "login.suniife.com" OR requesturl CONTAINS "login.synchronyfinanciai.com" OR requesturl CONTAINS "ping.taskus-sso.com" OR requesturl CONTAINS "teleperformance-incident.com" OR requesturl CONTAINS "telesignhr.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "telint-helpdesk.com" OR requesturl CONTAINS "login.thrivent-hr.com" OR requesturl CONTAINS "thrivent-hr.com" OR requesturl CONTAINS "corp-cox.com" OR requesturl CONTAINS "t-mobile-okta.com" OR requesturl CONTAINS "verify-tmobile.com" OR requesturl CONTAINS "storewatch-tmobile.com" OR requesturl CONTAINS "t-mobiie.net" OR requesturl CONTAINS "ally-hr.com" OR requesturl CONTAINS "corporate-ally.com" OR requesturl CONTAINS "transamerica-hr.com" OR requesturl CONTAINS "login.transamerica-hr.com" OR requesturl CONTAINS "okta-twilio.com" OR requesturl CONTAINS "typeform-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ultahub.com" OR destinationhostname CONTAINS "ultainternal.com" OR destinationhostname CONTAINS "unchainedprod-okta.com" OR destinationhostname CONTAINS "login.unumhr.com" OR destinationhostname CONTAINS "login.unum-hr.com" OR destinationhostname CONTAINS "unumhr.com" OR destinationhostname CONTAINS "login.uscc-hr.com" OR destinationhostname CONTAINS "tickets.zapto.org" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "connect-asurion.net" OR destinationhostname CONTAINS "supporthub-iqor.com" OR destinationhostname CONTAINS "vzapps-vzn.com" OR destinationhostname CONTAINS "xapo-okta.com" OR destinationhostname CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationhostname CONTAINS "ziffdavis-okta.com" OR destinationhostname CONTAINS "uscc-hr.com" OR destinationhostname CONTAINS "stargate-okta.com" OR destinationhostname CONTAINS "concentrix-servicedesk.com" OR destinationhostname CONTAINS "login.doordash-support.com" OR destinationhostname CONTAINS "okta-verify.com" OR destinationhostname CONTAINS "ibexgiobal.com" OR destinationhostname CONTAINS "mixpanel-okta.com" OR destinationhostname CONTAINS "robinhood-servicedesk.com" OR destinationhostname CONTAINS "zendesk-servicedesk.com" OR destinationhostname CONTAINS "okta-ouryahoo.com" OR destinationhostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ultahub.com" OR sourcentdomain CONTAINS "ultainternal.com" OR sourcentdomain CONTAINS "unchainedprod-okta.com" OR sourcentdomain CONTAINS "login.unumhr.com" OR sourcentdomain CONTAINS "login.unum-hr.com" OR sourcentdomain CONTAINS "unumhr.com" OR sourcentdomain CONTAINS "login.uscc-hr.com" OR sourcentdomain CONTAINS "tickets.zapto.org" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "connect-asurion.net" OR sourcentdomain CONTAINS "supporthub-iqor.com" OR sourcentdomain CONTAINS "vzapps-vzn.com" OR sourcentdomain CONTAINS "xapo-okta.com" OR sourcentdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcentdomain CONTAINS "ziffdavis-okta.com" OR sourcentdomain CONTAINS "uscc-hr.com" OR sourcentdomain CONTAINS "stargate-okta.com" OR sourcentdomain CONTAINS "concentrix-servicedesk.com" OR sourcentdomain CONTAINS "login.doordash-support.com" OR sourcentdomain CONTAINS "okta-verify.com" OR sourcentdomain CONTAINS "ibexgiobal.com" OR sourcentdomain CONTAINS "mixpanel-okta.com" OR sourcentdomain CONTAINS "robinhood-servicedesk.com" OR sourcentdomain CONTAINS "zendesk-servicedesk.com" OR sourcentdomain CONTAINS "okta-ouryahoo.com" OR sourcentdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ultahub.com" OR sourcehostname CONTAINS "ultainternal.com" OR sourcehostname CONTAINS "unchainedprod-okta.com" OR sourcehostname CONTAINS "login.unumhr.com" OR sourcehostname CONTAINS "login.unum-hr.com" OR sourcehostname CONTAINS "unumhr.com" OR sourcehostname CONTAINS "login.uscc-hr.com" OR sourcehostname CONTAINS "tickets.zapto.org" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "connect-asurion.net" OR sourcehostname CONTAINS "supporthub-iqor.com" OR sourcehostname CONTAINS "vzapps-vzn.com" OR sourcehostname CONTAINS "xapo-okta.com" OR sourcehostname CONTAINS "ouryahoo.okta.com.shortid.support" OR sourcehostname CONTAINS "ziffdavis-okta.com" OR sourcehostname CONTAINS "uscc-hr.com" OR sourcehostname CONTAINS "stargate-okta.com" OR sourcehostname CONTAINS "concentrix-servicedesk.com" OR sourcehostname CONTAINS "login.doordash-support.com" OR sourcehostname CONTAINS "okta-verify.com" OR sourcehostname CONTAINS "ibexgiobal.com" OR sourcehostname CONTAINS "mixpanel-okta.com" OR sourcehostname CONTAINS "robinhood-servicedesk.com" OR sourcehostname CONTAINS "zendesk-servicedesk.com" OR sourcehostname CONTAINS "okta-ouryahoo.com" OR sourcehostname CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ultahub.com" OR destinationntdomain CONTAINS "ultainternal.com" OR destinationntdomain CONTAINS "unchainedprod-okta.com" OR destinationntdomain CONTAINS "login.unumhr.com" OR destinationntdomain CONTAINS "login.unum-hr.com" OR destinationntdomain CONTAINS "unumhr.com" OR destinationntdomain CONTAINS "login.uscc-hr.com" OR destinationntdomain CONTAINS "tickets.zapto.org" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "connect-asurion.net" OR destinationntdomain CONTAINS "supporthub-iqor.com" OR destinationntdomain CONTAINS "vzapps-vzn.com" OR destinationntdomain CONTAINS "xapo-okta.com" OR destinationntdomain CONTAINS "ouryahoo.okta.com.shortid.support" OR destinationntdomain CONTAINS "ziffdavis-okta.com" OR destinationntdomain CONTAINS "uscc-hr.com" OR destinationntdomain CONTAINS "stargate-okta.com" OR destinationntdomain CONTAINS "concentrix-servicedesk.com" OR destinationntdomain CONTAINS "login.doordash-support.com" OR destinationntdomain CONTAINS "okta-verify.com" OR destinationntdomain CONTAINS "ibexgiobal.com" OR destinationntdomain CONTAINS "mixpanel-okta.com" OR destinationntdomain CONTAINS "robinhood-servicedesk.com" OR destinationntdomain CONTAINS "zendesk-servicedesk.com" OR destinationntdomain CONTAINS "okta-ouryahoo.com" OR destinationntdomain CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "ultahub.com" OR requesturl CONTAINS "ultainternal.com" OR requesturl CONTAINS "unchainedprod-okta.com" OR requesturl CONTAINS "login.unumhr.com" OR requesturl CONTAINS "login.unum-hr.com" OR requesturl CONTAINS "unumhr.com" OR requesturl CONTAINS "login.uscc-hr.com" OR requesturl CONTAINS "tickets.zapto.org" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "connect-asurion.net" OR requesturl CONTAINS "supporthub-iqor.com" OR requesturl CONTAINS "vzapps-vzn.com" OR requesturl CONTAINS "xapo-okta.com" OR requesturl CONTAINS "ouryahoo.okta.com.shortid.support" OR requesturl CONTAINS "ziffdavis-okta.com" OR requesturl CONTAINS "uscc-hr.com" OR requesturl CONTAINS "stargate-okta.com" OR requesturl CONTAINS "concentrix-servicedesk.com" OR requesturl CONTAINS "login.doordash-support.com" OR requesturl CONTAINS "okta-verify.com" OR requesturl CONTAINS "ibexgiobal.com" OR requesturl CONTAINS "mixpanel-okta.com" OR requesturl CONTAINS "robinhood-servicedesk.com" OR requesturl CONTAINS "zendesk-servicedesk.com" OR requesturl CONTAINS "okta-ouryahoo.com" OR requesturl CONTAINS "gd-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("142.93.3.117","80.78.25.254","80.78.24.166","80.78.28.234","179.43.187.101","193.149.176.19","68.183.20.231","161.35.98.8","67.217.228.42","162.33.179.76","67.205.185.135","161.35.96.229","144.202.121.111","64.95.13.215","80.78.24.176","138.68.47.14","80.78.22.244","137.220.43.146","45.77.122.253","216.245.184.53")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Content Management System" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Microsoft Windows" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Microsoft Windows" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Microsoft Windows" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Services / Applications" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Services / Applications" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / VPN" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / VPN" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / VPN" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Content Management System" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Network Access Control / NAC" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Network Access Control / NAC" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Virtualization / Containers" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Virtualization / Containers" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Privileged User" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Privileged User" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Privileged User" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Identity Management" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Identity Management" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Access / Identity Management" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Identity Access Management" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Identity Access Management" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Identity Access Management" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / WiFi" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / WiFi" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966","0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac","6604762c149476ff2f833b336d5077d2ac349bccacdf70eb86af28105028fbe0","00cc2176062c84db97399bb8761803d15ad1edf4b23eccb74979bb79d2a483ab","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","a23a15cf02ff5bfdf1b51335af4b91ca96c436781b9791280ab8c470643d07d7","c1e6d17cdae38320041149688fdab35409c2d466319873f33390b801b130dae4","f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb","a226437823c213da4b2f4cfdedc87bfa88204b17a0aebca1a33c3d6055178616","807865ab553996e521995c6624a41e026ef06f5370e1cad6a9647a68f7474798","0cea1ff596fe9a73f77bcd99ec9c77b69c27408a1b1c1c756300ef3db4c3c41f","9fea58b71ce27a360735a0ebe4badb2f0e1d17ed1b4baa229a568aec987c802c","436831126b5851ba76cd7bedc687ef08538fc639f7cc5e8665488aecfaeaf735","ab9f02f9eae92f52c983e18dafa2142203afe96a4f4a2390e061812989186e77","695bd0671a2d91d7087abb3c314f59cca2b52f05411aca478e208c4648616486","5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9","46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39","1f28bdadbf55e8c7023c4ac754eb963b776847e2d1826d8cf396b01807185f70","7d7ab8c1e2e469539e0d85d2b2166238c71bfd40ae7a373babf3744fc89a0ef8","4ae2d449cc534f746e351500a78ed83b2b4555cdf22a49e2e5ef48b10ec55bd6","3aeba4ab4ed3a5005444f108e6e54bc50c8c02421c1e6cfceab915e1de5cf862","53bb86ab4f9bf507d1f186b5be98f80960db4243afead96ef8ce6eafb2346587","d03ce20518692e3c2adc3f578ba92cab5e19f014664438b729d431a24be1823f","af1ddeab240bc7321e8c3dfc400ac8273e03af1ce0da9ed73e47570189795e4c","dd4782fc37ada8c2411fd65877eb3c3199aa67224ffa6c65b81c2e4b8658f727","c8ff5a54213c5ac0146b1ffe36974b07113f9f7060f951d5f80b93befa3b03f2","ce91909e4a421b6377468d22c6d68438da717c300a1b1326177aab3d01b5abee","8293806652949fc5056d2b841ad30010a8e83e0e6adfb102ef83c73bdea074eb","1d55d14c08eb1d61344f19d17f48b81cca3c4a24f54a0ee3707cf59b296db314","2d640430ec60721437ca4d5ff64d16cb0d3febce2e206fa749a9f8e007f9a5ae","8683370db6d2b7f5137199f0a6b012fcd09cfff6afb30064a23b3339927ed9c9","9833c1b277759b26478c88afe74680d5fbf3efff535dd803b1a3ebe4e7b8d466","c05d6607585f882476b6b7c9a39fd0bd2bb7ced3e469d5312971971048e2c594","d6cbc900942061d85477bda4dbfd7f77d823e8c08ebe80e1f9ff10bec20b5172","e534b01f04ad4721f7cde5e173a1098ae537d0f84a30d908d0eddae6a2fc4514")
