index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("f01c07f88071c8f71514db19f68c966f17ac8af0d3288913141714037352c99c","99544057a5215e756b67aa47815e27dc157eb850792e5eacda6796922bb9a50b","42492efa48785ca118d4b05f28570e7b6be4677a962cb7825a859ad5e3045710","5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25","3d7d75d66428c55dc81563c3bde5477977fadb3325d0224ef9313da133940077","fa257cca88522e76a7dc4a10311f739d17587f25fe447ae2b4c84027f2246705","57674d0ed1e03807ad9d53a9087388b1b9bf6e9e5d120dbe834730affebe2675")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "grace-fraser.site" OR destinationhostname CONTAINS "pam-beesly.site" OR destinationhostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "grace-fraser.site" OR sourcentdomain CONTAINS "pam-beesly.site" OR sourcentdomain CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "grace-fraser.site" OR sourcehostname CONTAINS "pam-beesly.site" OR sourcehostname CONTAINS "mozelllittel.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "grace-fraser.site" OR destinationntdomain CONTAINS "pam-beesly.site" OR destinationntdomain CONTAINS "mozelllittel.com")
