index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("185.118.164.198","104.224.169.214","45.61.136.199","185.118.166.66","149.28.134.209")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("20aebf6e20c46b6bfe44f2828adf3b91","b6b06a95cfeeee0efe8bc0cd54eac71d","83249cff833182b3299cbd4aac539c9a","143278845a3f5276a1dd5860e7488313","559b7150d936fffe728092b160c14d28","9337952aa3be0dacfc12898df3180f02","212784cf25f0adfaf9ba46db41c373d5","d414c7ede5a9d6d30e6d3fe547e27484","83e6da9cd8ccf9b0c04f00416b091076","7b501402c843034cd79151257aca189e","69f5c5f67850acdb373ddd106adce48c","b071a62d2dd745743c6de5f115d633b1","019122b1d783646f99c73a3c399cc334","f61dbac694d34c96830f184658610261","fc208a4d04c085edcea1ec5f402057f9","5528bb928e02926179fca52dd388b1f0","b8ecab09b7bfb42b9ace3666edf867a7","c4be6b466807540a22f62ffa6829540f","a00ab8ac0f11c3fcd5c557729afcbf89")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "colunm.tk")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "colunm.tk")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "colunm.tk")
