index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("20.11.11.67")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3f5ea95a5076b473cf8218170e820784","db1673a1e8316287cb940725bb6caa68","2798b66475cf0794e9b868d656defca7","626270d5bf16eb2c4dda2d9f6e0c4ef9","56450799fe4e44d7c5aff84d173760e8","d919fed03ec53654be59e15525c1448f","d22670ab9b13de79e442100f56985032","8e744f7b07484afcf87c454c6292e944","49bca397674f67e4c069068b596cab3e","8cefaa146178f5c3a297a7895cd3d1fc","326024bc9222ebec281ec53ca5598cc1","6f3047277719e2351ce14a54a39f7b15","765bd2fd32318a4cb9e4658194fe0fb5d94568e0","6a358afdd2c59f0bbfc7b1982ae6b0a782399923","0c3e0a5553cc29049fd8c5fc3a1af3ae6c0c298e","f585917fdb89b9dc849621676376b0b1e6b348fa","10037b4533df13983a75d74dcea32dc73665700c","9db9fe7b04bc5b2fc10f78da3891eb30c19a48b6","6e7540fa001fc992d2050b97ea17686d34863740","da845d8219d3315c02f84c27094965d02cdaa76c","d13d6d683855f5a547b96b6e2365c6f49a899d62","81779c94dbe2887ff1ff0fd4c15ee0c373bd0b40","5c25b93ebcedafcff0c85bcde2a0857ca72dc73e","7de335e005b0766268df918e7e3b64f4b3521c1e","33f136069d7c3a030b2e0738a5ee80d442dee1a202f6937121fa4e92a775fead","2affdebbaa4f0cfa64e5c42e70d78665ef9ccb2c731c5fe07582ccdfdc05b0cc","002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8","2b495829b8b3319f98e22f35d7bd48c4dea1b9bafe80749d628da99fede6d694","679955ff2a97ea11a181ae60c775eff78fadd767bc641ca0d1cff86a26df8ac8","efdbb19fb65bcf5c4a8feb3eab784682d01f3e75f711674e4d469d4dfe4a21f3","78cc364e761701455bdc4bce100c2836566e662b87b5c28251c178eba2e9ce7e","5d0872d07c6837dbc3bfa85fd8f79da3d83d7bb7504a6de7305833090b214f2c","874b946b674715c580e7b379e9597e48c85c04cca3a2790d943f56600b575d2f","c15a475f8324fdfcd959ffc40bcbee655cbdc5ab9cbda0caf59d63700989766f","0229404a146bb43ebc6d25d2145b493e950b2f92483be1b964f4f1c90ec6cf70","640128a35efc0ad83fe5b1461090f1b869c7a6ed0a8a661be403359d48a78085")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "gitcloudcache.com" OR destinationhostname CONTAINS "edgecloudc.com" OR destinationhostname CONTAINS "api.hostupoeui.com" OR destinationhostname CONTAINS "api.flushcdn.com" OR destinationhostname CONTAINS "const.be-government.com" OR destinationhostname CONTAINS "drmtake.tk" OR destinationhostname CONTAINS "inst.rsnet-devel.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "gitcloudcache.com" OR destinationhostname CONTAINS "edgecloudc.com" OR destinationhostname CONTAINS "api.hostupoeui.com" OR destinationhostname CONTAINS "api.flushcdn.com" OR destinationhostname CONTAINS "const.be-government.com" OR destinationhostname CONTAINS "drmtake.tk" OR destinationhostname CONTAINS "inst.rsnet-devel.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "gitcloudcache.com" OR destinationhostname CONTAINS "edgecloudc.com" OR destinationhostname CONTAINS "api.hostupoeui.com" OR destinationhostname CONTAINS "api.flushcdn.com" OR destinationhostname CONTAINS "const.be-government.com" OR destinationhostname CONTAINS "drmtake.tk" OR destinationhostname CONTAINS "inst.rsnet-devel.com")
