index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("157.230.28.192","159.89.128.13","165.22.84.147")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1","5e355f90b398cbb54829038c6e5d68e8c578405d142bdcc2386cf6161c8d7014","8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef","b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7","fcaed9faa026a26d00731068e956be39235487f63e0555b71019d16a59ea7e6b")
