index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "aa.zxcss.com" OR destinationhostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "aa.zxcss.com" OR sourcentdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "aa.zxcss.com" OR sourcehostname CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "aa.zxcss.com" OR destinationntdomain CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "aa.zxcss.com" OR requesturl CONTAINS "lt.yxavkb.xyz")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("53271b2ab6c327a68e78a7c0bf9f4044","011cedd9932207ee5539895e2a1ed60a","7d9c233b8c9e3f0ea290d2b84593c842","31c4a3f16baa5e0437fdd4603987b812","9f55b31c66a01953c17eea6ace66f636","33129e959221bf9d5211710747fddabe","e0f4afe374d75608d604fbf108eac64f","96ec8798bba011d5be952e0e6398795d","b434df66d0dd15c2f5e5b2975f2cfbe2","f4ace89337c8448f13d6eb538a79ce30","5e0845a9f08c1cfc7966824758b6953a","e981219f6ba673e977c5c1771f86b189","85a6e4448f4e5be1aa135861a2c35d35","21c7b2e6e0fb603c5fdd33781ac84b8f","1a0c704611395b53f632d4f6119ed20c","4eb724cc5f3d94510ba5fc8d4dba6bb6","47fc0ecb87c1296b860b2e10d119fc6c","2ed0a868520c31e27e69a0ab1a4e690d","985000d076e7720660ab8435639d5ad5","425c761a125b7cb674887121312bd16c","3f022d65129238c2d34e41deba3e24d3","30fe6a0ba1d77e05a19d87fcf99e7ca5")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="121.127.241.117" AND destinationport=20001 OR destinationaddress="20.214.201.166" AND destinationport=443 OR destinationaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="121.127.241.117" AND sourceport=20001 OR sourceaddress="20.214.201.166" AND sourceport=443 OR sourceaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="121.127.241.117" AND sourceport=20001 OR translatedipaddress="20.214.201.166" AND sourceport=443 OR translatedipaddress="202.87.223.124" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND destinationtranslatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND destinationtranslatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="121.127.241.117" AND translatedport=20001 OR destinationtranslatedaddress="20.214.201.166" AND translatedport=443 OR destinationtranslatedaddress="202.87.223.124" AND translatedport=443)
