index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("176.111.174.60")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1364419833344aa6ab3f301059d43b9506197501","9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4","96764a0a62e66a147a3d4db0e59a6e34")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "urbancinema.net" OR destinationhostname CONTAINS "noise1.xyz" OR destinationhostname CONTAINS "bvcinema.net" OR destinationhostname CONTAINS "bravomovies.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "urbancinema.net" OR destinationhostname CONTAINS "noise1.xyz" OR destinationhostname CONTAINS "bvcinema.net" OR destinationhostname CONTAINS "bravomovies.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "urbancinema.net" OR destinationhostname CONTAINS "noise1.xyz" OR destinationhostname CONTAINS "bvcinema.net" OR destinationhostname CONTAINS "bravomovies.net")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://noise1.xyz/campo/n/o")
