index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "twiiio-sso.com" OR destinationhostname CONTAINS "slack-mailchimp.com" OR destinationhostname CONTAINS "microsoft-sso.net" OR destinationhostname CONTAINS "ouryahoo-okta.org" OR destinationhostname CONTAINS "sykes-sso.com" OR destinationhostname CONTAINS "qualfon-sso.com" OR destinationhostname CONTAINS "att-mfa.com" OR destinationhostname CONTAINS "mcsupport-okta.com" OR destinationhostname CONTAINS "tmobie.net" OR destinationhostname CONTAINS "kucoinpin.com" OR destinationhostname CONTAINS "kucoin-pin.net" OR destinationhostname CONTAINS "telus-sso.com" OR destinationhostname CONTAINS "rogers-rci.net" OR destinationhostname CONTAINS "arise-okta.com" OR destinationhostname CONTAINS "rogers-rci.com" OR destinationhostname CONTAINS "medailia-okta.com" OR destinationhostname CONTAINS "teleperformance-help.com" OR destinationhostname CONTAINS "twilio-sso.com" OR destinationhostname CONTAINS "coin-base-okta.com" OR destinationhostname CONTAINS "teleperformance-sso.com" OR destinationhostname CONTAINS "transcom-sso.com" OR destinationhostname CONTAINS "att-sso.com" OR destinationhostname CONTAINS "cloudflare-okta.com" OR destinationhostname CONTAINS "twilio-okta.com" OR destinationhostname CONTAINS "vzw-corp.net" OR destinationhostname CONTAINS "iqor-tmobile.com" OR destinationhostname CONTAINS "sykes-vpn.com" OR destinationhostname CONTAINS "vzwcorp.co" OR destinationhostname CONTAINS "tmoblle.org" OR destinationhostname CONTAINS "att-id.net" OR destinationhostname CONTAINS "uid-att.com" OR destinationhostname CONTAINS "t-mobilers.com" OR destinationhostname CONTAINS "tmoble.net" OR destinationhostname CONTAINS "tmoblle.net" OR destinationhostname CONTAINS "teleperformance-usa.net" OR destinationhostname CONTAINS "tmobiler.net" OR destinationhostname CONTAINS "att-opus.net" OR destinationhostname CONTAINS "t-mobile-okta.org" OR destinationhostname CONTAINS "att-citrix.net" OR destinationhostname CONTAINS "okta-hubspot.com" OR destinationhostname CONTAINS "tp-usa.net" OR destinationhostname CONTAINS "t-mobiie.org" OR destinationhostname CONTAINS "t-mobiie.net" OR destinationhostname CONTAINS "okta-tmobiie.net" OR destinationhostname CONTAINS "okta-tmo.org" OR destinationhostname CONTAINS "tmo-okta.com" OR destinationhostname CONTAINS "loginxarth.tv" OR destinationhostname CONTAINS "binance-okta.com" OR destinationhostname CONTAINS "tmobile-okta.com" OR destinationhostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "twiiio-sso.com" OR sourcentdomain CONTAINS "slack-mailchimp.com" OR sourcentdomain CONTAINS "microsoft-sso.net" OR sourcentdomain CONTAINS "ouryahoo-okta.org" OR sourcentdomain CONTAINS "sykes-sso.com" OR sourcentdomain CONTAINS "qualfon-sso.com" OR sourcentdomain CONTAINS "att-mfa.com" OR sourcentdomain CONTAINS "mcsupport-okta.com" OR sourcentdomain CONTAINS "tmobie.net" OR sourcentdomain CONTAINS "kucoinpin.com" OR sourcentdomain CONTAINS "kucoin-pin.net" OR sourcentdomain CONTAINS "telus-sso.com" OR sourcentdomain CONTAINS "rogers-rci.net" OR sourcentdomain CONTAINS "arise-okta.com" OR sourcentdomain CONTAINS "rogers-rci.com" OR sourcentdomain CONTAINS "medailia-okta.com" OR sourcentdomain CONTAINS "teleperformance-help.com" OR sourcentdomain CONTAINS "twilio-sso.com" OR sourcentdomain CONTAINS "coin-base-okta.com" OR sourcentdomain CONTAINS "teleperformance-sso.com" OR sourcentdomain CONTAINS "transcom-sso.com" OR sourcentdomain CONTAINS "att-sso.com" OR sourcentdomain CONTAINS "cloudflare-okta.com" OR sourcentdomain CONTAINS "twilio-okta.com" OR sourcentdomain CONTAINS "vzw-corp.net" OR sourcentdomain CONTAINS "iqor-tmobile.com" OR sourcentdomain CONTAINS "sykes-vpn.com" OR sourcentdomain CONTAINS "vzwcorp.co" OR sourcentdomain CONTAINS "tmoblle.org" OR sourcentdomain CONTAINS "att-id.net" OR sourcentdomain CONTAINS "uid-att.com" OR sourcentdomain CONTAINS "t-mobilers.com" OR sourcentdomain CONTAINS "tmoble.net" OR sourcentdomain CONTAINS "tmoblle.net" OR sourcentdomain CONTAINS "teleperformance-usa.net" OR sourcentdomain CONTAINS "tmobiler.net" OR sourcentdomain CONTAINS "att-opus.net" OR sourcentdomain CONTAINS "t-mobile-okta.org" OR sourcentdomain CONTAINS "att-citrix.net" OR sourcentdomain CONTAINS "okta-hubspot.com" OR sourcentdomain CONTAINS "tp-usa.net" OR sourcentdomain CONTAINS "t-mobiie.org" OR sourcentdomain CONTAINS "t-mobiie.net" OR sourcentdomain CONTAINS "okta-tmobiie.net" OR sourcentdomain CONTAINS "okta-tmo.org" OR sourcentdomain CONTAINS "tmo-okta.com" OR sourcentdomain CONTAINS "loginxarth.tv" OR sourcentdomain CONTAINS "binance-okta.com" OR sourcentdomain CONTAINS "tmobile-okta.com" OR sourcentdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "twiiio-sso.com" OR sourcehostname CONTAINS "slack-mailchimp.com" OR sourcehostname CONTAINS "microsoft-sso.net" OR sourcehostname CONTAINS "ouryahoo-okta.org" OR sourcehostname CONTAINS "sykes-sso.com" OR sourcehostname CONTAINS "qualfon-sso.com" OR sourcehostname CONTAINS "att-mfa.com" OR sourcehostname CONTAINS "mcsupport-okta.com" OR sourcehostname CONTAINS "tmobie.net" OR sourcehostname CONTAINS "kucoinpin.com" OR sourcehostname CONTAINS "kucoin-pin.net" OR sourcehostname CONTAINS "telus-sso.com" OR sourcehostname CONTAINS "rogers-rci.net" OR sourcehostname CONTAINS "arise-okta.com" OR sourcehostname CONTAINS "rogers-rci.com" OR sourcehostname CONTAINS "medailia-okta.com" OR sourcehostname CONTAINS "teleperformance-help.com" OR sourcehostname CONTAINS "twilio-sso.com" OR sourcehostname CONTAINS "coin-base-okta.com" OR sourcehostname CONTAINS "teleperformance-sso.com" OR sourcehostname CONTAINS "transcom-sso.com" OR sourcehostname CONTAINS "att-sso.com" OR sourcehostname CONTAINS "cloudflare-okta.com" OR sourcehostname CONTAINS "twilio-okta.com" OR sourcehostname CONTAINS "vzw-corp.net" OR sourcehostname CONTAINS "iqor-tmobile.com" OR sourcehostname CONTAINS "sykes-vpn.com" OR sourcehostname CONTAINS "vzwcorp.co" OR sourcehostname CONTAINS "tmoblle.org" OR sourcehostname CONTAINS "att-id.net" OR sourcehostname CONTAINS "uid-att.com" OR sourcehostname CONTAINS "t-mobilers.com" OR sourcehostname CONTAINS "tmoble.net" OR sourcehostname CONTAINS "tmoblle.net" OR sourcehostname CONTAINS "teleperformance-usa.net" OR sourcehostname CONTAINS "tmobiler.net" OR sourcehostname CONTAINS "att-opus.net" OR sourcehostname CONTAINS "t-mobile-okta.org" OR sourcehostname CONTAINS "att-citrix.net" OR sourcehostname CONTAINS "okta-hubspot.com" OR sourcehostname CONTAINS "tp-usa.net" OR sourcehostname CONTAINS "t-mobiie.org" OR sourcehostname CONTAINS "t-mobiie.net" OR sourcehostname CONTAINS "okta-tmobiie.net" OR sourcehostname CONTAINS "okta-tmo.org" OR sourcehostname CONTAINS "tmo-okta.com" OR sourcehostname CONTAINS "loginxarth.tv" OR sourcehostname CONTAINS "binance-okta.com" OR sourcehostname CONTAINS "tmobile-okta.com" OR sourcehostname CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "twiiio-sso.com" OR destinationntdomain CONTAINS "slack-mailchimp.com" OR destinationntdomain CONTAINS "microsoft-sso.net" OR destinationntdomain CONTAINS "ouryahoo-okta.org" OR destinationntdomain CONTAINS "sykes-sso.com" OR destinationntdomain CONTAINS "qualfon-sso.com" OR destinationntdomain CONTAINS "att-mfa.com" OR destinationntdomain CONTAINS "mcsupport-okta.com" OR destinationntdomain CONTAINS "tmobie.net" OR destinationntdomain CONTAINS "kucoinpin.com" OR destinationntdomain CONTAINS "kucoin-pin.net" OR destinationntdomain CONTAINS "telus-sso.com" OR destinationntdomain CONTAINS "rogers-rci.net" OR destinationntdomain CONTAINS "arise-okta.com" OR destinationntdomain CONTAINS "rogers-rci.com" OR destinationntdomain CONTAINS "medailia-okta.com" OR destinationntdomain CONTAINS "teleperformance-help.com" OR destinationntdomain CONTAINS "twilio-sso.com" OR destinationntdomain CONTAINS "coin-base-okta.com" OR destinationntdomain CONTAINS "teleperformance-sso.com" OR destinationntdomain CONTAINS "transcom-sso.com" OR destinationntdomain CONTAINS "att-sso.com" OR destinationntdomain CONTAINS "cloudflare-okta.com" OR destinationntdomain CONTAINS "twilio-okta.com" OR destinationntdomain CONTAINS "vzw-corp.net" OR destinationntdomain CONTAINS "iqor-tmobile.com" OR destinationntdomain CONTAINS "sykes-vpn.com" OR destinationntdomain CONTAINS "vzwcorp.co" OR destinationntdomain CONTAINS "tmoblle.org" OR destinationntdomain CONTAINS "att-id.net" OR destinationntdomain CONTAINS "uid-att.com" OR destinationntdomain CONTAINS "t-mobilers.com" OR destinationntdomain CONTAINS "tmoble.net" OR destinationntdomain CONTAINS "tmoblle.net" OR destinationntdomain CONTAINS "teleperformance-usa.net" OR destinationntdomain CONTAINS "tmobiler.net" OR destinationntdomain CONTAINS "att-opus.net" OR destinationntdomain CONTAINS "t-mobile-okta.org" OR destinationntdomain CONTAINS "att-citrix.net" OR destinationntdomain CONTAINS "okta-hubspot.com" OR destinationntdomain CONTAINS "tp-usa.net" OR destinationntdomain CONTAINS "t-mobiie.org" OR destinationntdomain CONTAINS "t-mobiie.net" OR destinationntdomain CONTAINS "okta-tmobiie.net" OR destinationntdomain CONTAINS "okta-tmo.org" OR destinationntdomain CONTAINS "tmo-okta.com" OR destinationntdomain CONTAINS "loginxarth.tv" OR destinationntdomain CONTAINS "binance-okta.com" OR destinationntdomain CONTAINS "tmobile-okta.com" OR destinationntdomain CONTAINS "riotgames-okta.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "alorica-vpn.com" OR destinationhostname CONTAINS "att-vpn.org" OR destinationhostname CONTAINS "att-support.org" OR destinationhostname CONTAINS "tmo.ac" OR destinationhostname CONTAINS "bestbuy-vpn.com" OR destinationhostname CONTAINS "box-okta.org" OR destinationhostname CONTAINS "sendgrid-okta.org" OR destinationhostname CONTAINS "ouryahooinc-okta.com" OR destinationhostname CONTAINS "internai-customer.io" OR destinationhostname CONTAINS "twiiio.net" OR destinationhostname CONTAINS "att-rsa.com" OR destinationhostname CONTAINS "mailgun-okta.com" OR destinationhostname CONTAINS "kucoinpin.net" OR destinationhostname CONTAINS "kucoin-sso.net" OR destinationhostname CONTAINS "rogers-ssp.com" OR destinationhostname CONTAINS "cb-okta.com" OR destinationhostname CONTAINS "verizon-sso.net" OR destinationhostname CONTAINS "quaifone.com" OR destinationhostname CONTAINS "cb-okta.net" OR destinationhostname CONTAINS "rogers-help.net" OR destinationhostname CONTAINS "att-sso.net" OR destinationhostname CONTAINS "rogers-sso.com" OR destinationhostname CONTAINS "transcom-help.com" OR destinationhostname CONTAINS "hubspot-sso.com" OR destinationhostname CONTAINS "sitel-help.com" OR destinationhostname CONTAINS "iqor-helpdesk.com" OR destinationhostname CONTAINS "iqor-help.net" OR destinationhostname CONTAINS "iqor-help.com" OR destinationhostname CONTAINS "startek-vpn.com" OR destinationhostname CONTAINS "t-mobiie.co" OR destinationhostname CONTAINS "att-uid.net" OR destinationhostname CONTAINS "att-uid.com" OR destinationhostname CONTAINS "tp-update.com" OR destinationhostname CONTAINS "mytpusa.net" OR destinationhostname CONTAINS "t-mobile-okta.net" OR destinationhostname CONTAINS "opus-att.com" OR destinationhostname CONTAINS "mytpusa.com" OR destinationhostname CONTAINS "tpusa-citrix.com" OR destinationhostname CONTAINS "mailchimp-okta.com" OR destinationhostname CONTAINS "tmoblie.net" OR destinationhostname CONTAINS "okta-oath.com" OR destinationhostname CONTAINS "t-mobile-okta.com" OR destinationhostname CONTAINS "okta-tmobile.org" OR destinationhostname CONTAINS "okta.tmobiie.net" OR destinationhostname CONTAINS "snap-okta.net" OR destinationhostname CONTAINS "tmobile-okta.net" OR destinationhostname CONTAINS "concentrixhelp.com" OR destinationhostname CONTAINS "corp-att.net" OR destinationhostname CONTAINS "ttecvpn.com" OR destinationhostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "alorica-vpn.com" OR sourcentdomain CONTAINS "att-vpn.org" OR sourcentdomain CONTAINS "att-support.org" OR sourcentdomain CONTAINS "tmo.ac" OR sourcentdomain CONTAINS "bestbuy-vpn.com" OR sourcentdomain CONTAINS "box-okta.org" OR sourcentdomain CONTAINS "sendgrid-okta.org" OR sourcentdomain CONTAINS "ouryahooinc-okta.com" OR sourcentdomain CONTAINS "internai-customer.io" OR sourcentdomain CONTAINS "twiiio.net" OR sourcentdomain CONTAINS "att-rsa.com" OR sourcentdomain CONTAINS "mailgun-okta.com" OR sourcentdomain CONTAINS "kucoinpin.net" OR sourcentdomain CONTAINS "kucoin-sso.net" OR sourcentdomain CONTAINS "rogers-ssp.com" OR sourcentdomain CONTAINS "cb-okta.com" OR sourcentdomain CONTAINS "verizon-sso.net" OR sourcentdomain CONTAINS "quaifone.com" OR sourcentdomain CONTAINS "cb-okta.net" OR sourcentdomain CONTAINS "rogers-help.net" OR sourcentdomain CONTAINS "att-sso.net" OR sourcentdomain CONTAINS "rogers-sso.com" OR sourcentdomain CONTAINS "transcom-help.com" OR sourcentdomain CONTAINS "hubspot-sso.com" OR sourcentdomain CONTAINS "sitel-help.com" OR sourcentdomain CONTAINS "iqor-helpdesk.com" OR sourcentdomain CONTAINS "iqor-help.net" OR sourcentdomain CONTAINS "iqor-help.com" OR sourcentdomain CONTAINS "startek-vpn.com" OR sourcentdomain CONTAINS "t-mobiie.co" OR sourcentdomain CONTAINS "att-uid.net" OR sourcentdomain CONTAINS "att-uid.com" OR sourcentdomain CONTAINS "tp-update.com" OR sourcentdomain CONTAINS "mytpusa.net" OR sourcentdomain CONTAINS "t-mobile-okta.net" OR sourcentdomain CONTAINS "opus-att.com" OR sourcentdomain CONTAINS "mytpusa.com" OR sourcentdomain CONTAINS "tpusa-citrix.com" OR sourcentdomain CONTAINS "mailchimp-okta.com" OR sourcentdomain CONTAINS "tmoblie.net" OR sourcentdomain CONTAINS "okta-oath.com" OR sourcentdomain CONTAINS "t-mobile-okta.com" OR sourcentdomain CONTAINS "okta-tmobile.org" OR sourcentdomain CONTAINS "okta.tmobiie.net" OR sourcentdomain CONTAINS "snap-okta.net" OR sourcentdomain CONTAINS "tmobile-okta.net" OR sourcentdomain CONTAINS "concentrixhelp.com" OR sourcentdomain CONTAINS "corp-att.net" OR sourcentdomain CONTAINS "ttecvpn.com" OR sourcentdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "alorica-vpn.com" OR sourcehostname CONTAINS "att-vpn.org" OR sourcehostname CONTAINS "att-support.org" OR sourcehostname CONTAINS "tmo.ac" OR sourcehostname CONTAINS "bestbuy-vpn.com" OR sourcehostname CONTAINS "box-okta.org" OR sourcehostname CONTAINS "sendgrid-okta.org" OR sourcehostname CONTAINS "ouryahooinc-okta.com" OR sourcehostname CONTAINS "internai-customer.io" OR sourcehostname CONTAINS "twiiio.net" OR sourcehostname CONTAINS "att-rsa.com" OR sourcehostname CONTAINS "mailgun-okta.com" OR sourcehostname CONTAINS "kucoinpin.net" OR sourcehostname CONTAINS "kucoin-sso.net" OR sourcehostname CONTAINS "rogers-ssp.com" OR sourcehostname CONTAINS "cb-okta.com" OR sourcehostname CONTAINS "verizon-sso.net" OR sourcehostname CONTAINS "quaifone.com" OR sourcehostname CONTAINS "cb-okta.net" OR sourcehostname CONTAINS "rogers-help.net" OR sourcehostname CONTAINS "att-sso.net" OR sourcehostname CONTAINS "rogers-sso.com" OR sourcehostname CONTAINS "transcom-help.com" OR sourcehostname CONTAINS "hubspot-sso.com" OR sourcehostname CONTAINS "sitel-help.com" OR sourcehostname CONTAINS "iqor-helpdesk.com" OR sourcehostname CONTAINS "iqor-help.net" OR sourcehostname CONTAINS "iqor-help.com" OR sourcehostname CONTAINS "startek-vpn.com" OR sourcehostname CONTAINS "t-mobiie.co" OR sourcehostname CONTAINS "att-uid.net" OR sourcehostname CONTAINS "att-uid.com" OR sourcehostname CONTAINS "tp-update.com" OR sourcehostname CONTAINS "mytpusa.net" OR sourcehostname CONTAINS "t-mobile-okta.net" OR sourcehostname CONTAINS "opus-att.com" OR sourcehostname CONTAINS "mytpusa.com" OR sourcehostname CONTAINS "tpusa-citrix.com" OR sourcehostname CONTAINS "mailchimp-okta.com" OR sourcehostname CONTAINS "tmoblie.net" OR sourcehostname CONTAINS "okta-oath.com" OR sourcehostname CONTAINS "t-mobile-okta.com" OR sourcehostname CONTAINS "okta-tmobile.org" OR sourcehostname CONTAINS "okta.tmobiie.net" OR sourcehostname CONTAINS "snap-okta.net" OR sourcehostname CONTAINS "tmobile-okta.net" OR sourcehostname CONTAINS "concentrixhelp.com" OR sourcehostname CONTAINS "corp-att.net" OR sourcehostname CONTAINS "ttecvpn.com" OR sourcehostname CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "alorica-vpn.com" OR destinationntdomain CONTAINS "att-vpn.org" OR destinationntdomain CONTAINS "att-support.org" OR destinationntdomain CONTAINS "tmo.ac" OR destinationntdomain CONTAINS "bestbuy-vpn.com" OR destinationntdomain CONTAINS "box-okta.org" OR destinationntdomain CONTAINS "sendgrid-okta.org" OR destinationntdomain CONTAINS "ouryahooinc-okta.com" OR destinationntdomain CONTAINS "internai-customer.io" OR destinationntdomain CONTAINS "twiiio.net" OR destinationntdomain CONTAINS "att-rsa.com" OR destinationntdomain CONTAINS "mailgun-okta.com" OR destinationntdomain CONTAINS "kucoinpin.net" OR destinationntdomain CONTAINS "kucoin-sso.net" OR destinationntdomain CONTAINS "rogers-ssp.com" OR destinationntdomain CONTAINS "cb-okta.com" OR destinationntdomain CONTAINS "verizon-sso.net" OR destinationntdomain CONTAINS "quaifone.com" OR destinationntdomain CONTAINS "cb-okta.net" OR destinationntdomain CONTAINS "rogers-help.net" OR destinationntdomain CONTAINS "att-sso.net" OR destinationntdomain CONTAINS "rogers-sso.com" OR destinationntdomain CONTAINS "transcom-help.com" OR destinationntdomain CONTAINS "hubspot-sso.com" OR destinationntdomain CONTAINS "sitel-help.com" OR destinationntdomain CONTAINS "iqor-helpdesk.com" OR destinationntdomain CONTAINS "iqor-help.net" OR destinationntdomain CONTAINS "iqor-help.com" OR destinationntdomain CONTAINS "startek-vpn.com" OR destinationntdomain CONTAINS "t-mobiie.co" OR destinationntdomain CONTAINS "att-uid.net" OR destinationntdomain CONTAINS "att-uid.com" OR destinationntdomain CONTAINS "tp-update.com" OR destinationntdomain CONTAINS "mytpusa.net" OR destinationntdomain CONTAINS "t-mobile-okta.net" OR destinationntdomain CONTAINS "opus-att.com" OR destinationntdomain CONTAINS "mytpusa.com" OR destinationntdomain CONTAINS "tpusa-citrix.com" OR destinationntdomain CONTAINS "mailchimp-okta.com" OR destinationntdomain CONTAINS "tmoblie.net" OR destinationntdomain CONTAINS "okta-oath.com" OR destinationntdomain CONTAINS "t-mobile-okta.com" OR destinationntdomain CONTAINS "okta-tmobile.org" OR destinationntdomain CONTAINS "okta.tmobiie.net" OR destinationntdomain CONTAINS "snap-okta.net" OR destinationntdomain CONTAINS "tmobile-okta.net" OR destinationntdomain CONTAINS "concentrixhelp.com" OR destinationntdomain CONTAINS "corp-att.net" OR destinationntdomain CONTAINS "ttecvpn.com" OR destinationntdomain CONTAINS "kucoin-pin.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mlcrosoft.info" OR destinationhostname CONTAINS "ouryahoo-okta.com" OR destinationhostname CONTAINS "twiiio.org" OR destinationhostname CONTAINS "sprint-idg.net" OR destinationhostname CONTAINS "twiiio-okta.net" OR destinationhostname CONTAINS "iqor-duo.net" OR destinationhostname CONTAINS "taskus-sso.com" OR destinationhostname CONTAINS "quaifon.com" OR destinationhostname CONTAINS "twilio-help.com" OR destinationhostname CONTAINS "concentrlx.com" OR destinationhostname CONTAINS "atento-help.com" OR destinationhostname CONTAINS "mailchimp-sso.com" OR destinationhostname CONTAINS "bandwidth-okta.com" OR destinationhostname CONTAINS "ttec-help.com" OR destinationhostname CONTAINS "metropcs-edge.net" OR destinationhostname CONTAINS "t-moblie-okta.com" OR destinationhostname CONTAINS "intercom-vpn.com" OR destinationhostname CONTAINS "t-moblier.org" OR destinationhostname CONTAINS "twit-vpn.com" OR destinationhostname CONTAINS "att-citrix.com" OR destinationhostname CONTAINS "twitter-okta.com" OR destinationhostname CONTAINS "t-mobile-okta.us" OR destinationhostname CONTAINS "okta-drop.com" OR destinationhostname CONTAINS "snap-okta.com" OR destinationhostname CONTAINS "riotgames-vpn.com" OR destinationhostname CONTAINS "att-vmware.com" OR destinationhostname CONTAINS "att-vpn.com" OR destinationhostname CONTAINS "boxokta.com" OR destinationhostname CONTAINS "mlcrosoft.cloud" OR destinationhostname CONTAINS "ouryahoo-okta.net" OR destinationhostname CONTAINS "teleperformanceusa-sso.com" OR destinationhostname CONTAINS "iqor-portal.com" OR destinationhostname CONTAINS "t-moblle.org" OR destinationhostname CONTAINS "tmoblle.co" OR destinationhostname CONTAINS "concentrix-sso.com" OR destinationhostname CONTAINS "sykes-help.com" OR destinationhostname CONTAINS "maiichlmp.com" OR destinationhostname CONTAINS "att-uid.co" OR destinationhostname CONTAINS "sutherlandglobal-vpn.com" OR destinationhostname CONTAINS "epicgames-vpn.com" OR destinationhostname CONTAINS "infosys-vpn.com" OR destinationhostname CONTAINS "epicgames-okta.com" OR destinationhostname CONTAINS "customer-internal.com" OR destinationhostname CONTAINS "kucoin-sso.com" OR destinationhostname CONTAINS "techmahindra-sso.com" OR destinationhostname CONTAINS "tmo-sso.net" OR destinationhostname CONTAINS "cgslnc-okta.com" OR destinationhostname CONTAINS "iqor-sso.com" OR destinationhostname CONTAINS "t-moblie.help" OR destinationhostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mlcrosoft.info" OR sourcentdomain CONTAINS "ouryahoo-okta.com" OR sourcentdomain CONTAINS "twiiio.org" OR sourcentdomain CONTAINS "sprint-idg.net" OR sourcentdomain CONTAINS "twiiio-okta.net" OR sourcentdomain CONTAINS "iqor-duo.net" OR sourcentdomain CONTAINS "taskus-sso.com" OR sourcentdomain CONTAINS "quaifon.com" OR sourcentdomain CONTAINS "twilio-help.com" OR sourcentdomain CONTAINS "concentrlx.com" OR sourcentdomain CONTAINS "atento-help.com" OR sourcentdomain CONTAINS "mailchimp-sso.com" OR sourcentdomain CONTAINS "bandwidth-okta.com" OR sourcentdomain CONTAINS "ttec-help.com" OR sourcentdomain CONTAINS "metropcs-edge.net" OR sourcentdomain CONTAINS "t-moblie-okta.com" OR sourcentdomain CONTAINS "intercom-vpn.com" OR sourcentdomain CONTAINS "t-moblier.org" OR sourcentdomain CONTAINS "twit-vpn.com" OR sourcentdomain CONTAINS "att-citrix.com" OR sourcentdomain CONTAINS "twitter-okta.com" OR sourcentdomain CONTAINS "t-mobile-okta.us" OR sourcentdomain CONTAINS "okta-drop.com" OR sourcentdomain CONTAINS "snap-okta.com" OR sourcentdomain CONTAINS "riotgames-vpn.com" OR sourcentdomain CONTAINS "att-vmware.com" OR sourcentdomain CONTAINS "att-vpn.com" OR sourcentdomain CONTAINS "boxokta.com" OR sourcentdomain CONTAINS "mlcrosoft.cloud" OR sourcentdomain CONTAINS "ouryahoo-okta.net" OR sourcentdomain CONTAINS "teleperformanceusa-sso.com" OR sourcentdomain CONTAINS "iqor-portal.com" OR sourcentdomain CONTAINS "t-moblle.org" OR sourcentdomain CONTAINS "tmoblle.co" OR sourcentdomain CONTAINS "concentrix-sso.com" OR sourcentdomain CONTAINS "sykes-help.com" OR sourcentdomain CONTAINS "maiichlmp.com" OR sourcentdomain CONTAINS "att-uid.co" OR sourcentdomain CONTAINS "sutherlandglobal-vpn.com" OR sourcentdomain CONTAINS "epicgames-vpn.com" OR sourcentdomain CONTAINS "infosys-vpn.com" OR sourcentdomain CONTAINS "epicgames-okta.com" OR sourcentdomain CONTAINS "customer-internal.com" OR sourcentdomain CONTAINS "kucoin-sso.com" OR sourcentdomain CONTAINS "techmahindra-sso.com" OR sourcentdomain CONTAINS "tmo-sso.net" OR sourcentdomain CONTAINS "cgslnc-okta.com" OR sourcentdomain CONTAINS "iqor-sso.com" OR sourcentdomain CONTAINS "t-moblie.help" OR sourcentdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mlcrosoft.info" OR sourcehostname CONTAINS "ouryahoo-okta.com" OR sourcehostname CONTAINS "twiiio.org" OR sourcehostname CONTAINS "sprint-idg.net" OR sourcehostname CONTAINS "twiiio-okta.net" OR sourcehostname CONTAINS "iqor-duo.net" OR sourcehostname CONTAINS "taskus-sso.com" OR sourcehostname CONTAINS "quaifon.com" OR sourcehostname CONTAINS "twilio-help.com" OR sourcehostname CONTAINS "concentrlx.com" OR sourcehostname CONTAINS "atento-help.com" OR sourcehostname CONTAINS "mailchimp-sso.com" OR sourcehostname CONTAINS "bandwidth-okta.com" OR sourcehostname CONTAINS "ttec-help.com" OR sourcehostname CONTAINS "metropcs-edge.net" OR sourcehostname CONTAINS "t-moblie-okta.com" OR sourcehostname CONTAINS "intercom-vpn.com" OR sourcehostname CONTAINS "t-moblier.org" OR sourcehostname CONTAINS "twit-vpn.com" OR sourcehostname CONTAINS "att-citrix.com" OR sourcehostname CONTAINS "twitter-okta.com" OR sourcehostname CONTAINS "t-mobile-okta.us" OR sourcehostname CONTAINS "okta-drop.com" OR sourcehostname CONTAINS "snap-okta.com" OR sourcehostname CONTAINS "riotgames-vpn.com" OR sourcehostname CONTAINS "att-vmware.com" OR sourcehostname CONTAINS "att-vpn.com" OR sourcehostname CONTAINS "boxokta.com" OR sourcehostname CONTAINS "mlcrosoft.cloud" OR sourcehostname CONTAINS "ouryahoo-okta.net" OR sourcehostname CONTAINS "teleperformanceusa-sso.com" OR sourcehostname CONTAINS "iqor-portal.com" OR sourcehostname CONTAINS "t-moblle.org" OR sourcehostname CONTAINS "tmoblle.co" OR sourcehostname CONTAINS "concentrix-sso.com" OR sourcehostname CONTAINS "sykes-help.com" OR sourcehostname CONTAINS "maiichlmp.com" OR sourcehostname CONTAINS "att-uid.co" OR sourcehostname CONTAINS "sutherlandglobal-vpn.com" OR sourcehostname CONTAINS "epicgames-vpn.com" OR sourcehostname CONTAINS "infosys-vpn.com" OR sourcehostname CONTAINS "epicgames-okta.com" OR sourcehostname CONTAINS "customer-internal.com" OR sourcehostname CONTAINS "kucoin-sso.com" OR sourcehostname CONTAINS "techmahindra-sso.com" OR sourcehostname CONTAINS "tmo-sso.net" OR sourcehostname CONTAINS "cgslnc-okta.com" OR sourcehostname CONTAINS "iqor-sso.com" OR sourcehostname CONTAINS "t-moblie.help" OR sourcehostname CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mlcrosoft.info" OR destinationntdomain CONTAINS "ouryahoo-okta.com" OR destinationntdomain CONTAINS "twiiio.org" OR destinationntdomain CONTAINS "sprint-idg.net" OR destinationntdomain CONTAINS "twiiio-okta.net" OR destinationntdomain CONTAINS "iqor-duo.net" OR destinationntdomain CONTAINS "taskus-sso.com" OR destinationntdomain CONTAINS "quaifon.com" OR destinationntdomain CONTAINS "twilio-help.com" OR destinationntdomain CONTAINS "concentrlx.com" OR destinationntdomain CONTAINS "atento-help.com" OR destinationntdomain CONTAINS "mailchimp-sso.com" OR destinationntdomain CONTAINS "bandwidth-okta.com" OR destinationntdomain CONTAINS "ttec-help.com" OR destinationntdomain CONTAINS "metropcs-edge.net" OR destinationntdomain CONTAINS "t-moblie-okta.com" OR destinationntdomain CONTAINS "intercom-vpn.com" OR destinationntdomain CONTAINS "t-moblier.org" OR destinationntdomain CONTAINS "twit-vpn.com" OR destinationntdomain CONTAINS "att-citrix.com" OR destinationntdomain CONTAINS "twitter-okta.com" OR destinationntdomain CONTAINS "t-mobile-okta.us" OR destinationntdomain CONTAINS "okta-drop.com" OR destinationntdomain CONTAINS "snap-okta.com" OR destinationntdomain CONTAINS "riotgames-vpn.com" OR destinationntdomain CONTAINS "att-vmware.com" OR destinationntdomain CONTAINS "att-vpn.com" OR destinationntdomain CONTAINS "boxokta.com" OR destinationntdomain CONTAINS "mlcrosoft.cloud" OR destinationntdomain CONTAINS "ouryahoo-okta.net" OR destinationntdomain CONTAINS "teleperformanceusa-sso.com" OR destinationntdomain CONTAINS "iqor-portal.com" OR destinationntdomain CONTAINS "t-moblle.org" OR destinationntdomain CONTAINS "tmoblle.co" OR destinationntdomain CONTAINS "concentrix-sso.com" OR destinationntdomain CONTAINS "sykes-help.com" OR destinationntdomain CONTAINS "maiichlmp.com" OR destinationntdomain CONTAINS "att-uid.co" OR destinationntdomain CONTAINS "sutherlandglobal-vpn.com" OR destinationntdomain CONTAINS "epicgames-vpn.com" OR destinationntdomain CONTAINS "infosys-vpn.com" OR destinationntdomain CONTAINS "epicgames-okta.com" OR destinationntdomain CONTAINS "customer-internal.com" OR destinationntdomain CONTAINS "kucoin-sso.com" OR destinationntdomain CONTAINS "techmahindra-sso.com" OR destinationntdomain CONTAINS "tmo-sso.net" OR destinationntdomain CONTAINS "cgslnc-okta.com" OR destinationntdomain CONTAINS "iqor-sso.com" OR destinationntdomain CONTAINS "t-moblie.help" OR destinationntdomain CONTAINS "sitel-sso.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "at-uid.com" OR destinationhostname CONTAINS "sitel-vpn.net" OR destinationhostname CONTAINS "ttec-vpn.com" OR destinationhostname CONTAINS "evernote-onelogin.com" OR destinationhostname CONTAINS "activecampaign-okta.com" OR destinationhostname CONTAINS "one-login.co" OR destinationhostname CONTAINS "klaviyo-sso.com" OR destinationhostname CONTAINS "tmo-sso.com" OR destinationhostname CONTAINS "sinch-sso.com" OR destinationhostname CONTAINS "okta-riotgames.com" OR destinationhostname CONTAINS "okta-sso.net" OR destinationhostname CONTAINS "conexusonline.com" OR destinationhostname CONTAINS "rogers-sso.net" OR destinationhostname CONTAINS "twlilo.net" OR destinationhostname CONTAINS "mailchimp-help.com" OR destinationhostname CONTAINS "att-ctx.com" OR destinationhostname CONTAINS "taskus-vpn.com" OR destinationhostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "at-uid.com" OR sourcentdomain CONTAINS "sitel-vpn.net" OR sourcentdomain CONTAINS "ttec-vpn.com" OR sourcentdomain CONTAINS "evernote-onelogin.com" OR sourcentdomain CONTAINS "activecampaign-okta.com" OR sourcentdomain CONTAINS "one-login.co" OR sourcentdomain CONTAINS "klaviyo-sso.com" OR sourcentdomain CONTAINS "tmo-sso.com" OR sourcentdomain CONTAINS "sinch-sso.com" OR sourcentdomain CONTAINS "okta-riotgames.com" OR sourcentdomain CONTAINS "okta-sso.net" OR sourcentdomain CONTAINS "conexusonline.com" OR sourcentdomain CONTAINS "rogers-sso.net" OR sourcentdomain CONTAINS "twlilo.net" OR sourcentdomain CONTAINS "mailchimp-help.com" OR sourcentdomain CONTAINS "att-ctx.com" OR sourcentdomain CONTAINS "taskus-vpn.com" OR sourcentdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "at-uid.com" OR sourcehostname CONTAINS "sitel-vpn.net" OR sourcehostname CONTAINS "ttec-vpn.com" OR sourcehostname CONTAINS "evernote-onelogin.com" OR sourcehostname CONTAINS "activecampaign-okta.com" OR sourcehostname CONTAINS "one-login.co" OR sourcehostname CONTAINS "klaviyo-sso.com" OR sourcehostname CONTAINS "tmo-sso.com" OR sourcehostname CONTAINS "sinch-sso.com" OR sourcehostname CONTAINS "okta-riotgames.com" OR sourcehostname CONTAINS "okta-sso.net" OR sourcehostname CONTAINS "conexusonline.com" OR sourcehostname CONTAINS "rogers-sso.net" OR sourcehostname CONTAINS "twlilo.net" OR sourcehostname CONTAINS "mailchimp-help.com" OR sourcehostname CONTAINS "att-ctx.com" OR sourcehostname CONTAINS "taskus-vpn.com" OR sourcehostname CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "at-uid.com" OR destinationntdomain CONTAINS "sitel-vpn.net" OR destinationntdomain CONTAINS "ttec-vpn.com" OR destinationntdomain CONTAINS "evernote-onelogin.com" OR destinationntdomain CONTAINS "activecampaign-okta.com" OR destinationntdomain CONTAINS "one-login.co" OR destinationntdomain CONTAINS "klaviyo-sso.com" OR destinationntdomain CONTAINS "tmo-sso.com" OR destinationntdomain CONTAINS "sinch-sso.com" OR destinationntdomain CONTAINS "okta-riotgames.com" OR destinationntdomain CONTAINS "okta-sso.net" OR destinationntdomain CONTAINS "conexusonline.com" OR destinationntdomain CONTAINS "rogers-sso.net" OR destinationntdomain CONTAINS "twlilo.net" OR destinationntdomain CONTAINS "mailchimp-help.com" OR destinationntdomain CONTAINS "att-ctx.com" OR destinationntdomain CONTAINS "taskus-vpn.com" OR destinationntdomain CONTAINS "riotgames-vpn.net")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.76.80.199","66.42.107.233","45.32.66.165","45.76.238.53","155.138.240.251","149.28.37.137","149.248.1.50","108.61.119.20","149.28.212.53","140.82.63.209","144.202.82.47","45.63.39.116","149.248.62.54","66.42.91.138","216.128.141.52","45.63.39.151","143.244.178.172","66.42.90.140","165.227.57.16","147.182.201.149","146.190.42.89","146.190.44.66","167.99.221.10","147.182.132.52","167.172.141.4","67.205.146.165","143.198.164.89","45.63.79.150","144.202.117.57","138.197.7.153","144.202.17.28","45.76.171.233","95.179.238.3","137.184.55.52","159.223.160.128","69.55.49.252","143.198.156.234","159.89.93.54","161.35.119.80","67.205.151.76","138.68.27.0","104.248.234.27","67.205.154.21","64.227.23.72","159.89.159.7","66.175.217.141","172.105.98.36","138.197.194.87","138.68.26.2","149.28.110.16","157.245.246.85","147.182.218.194","104.248.236.115","192.241.142.113","165.227.79.161","137.184.136.163")
