index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("213.252.244.114")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("213.252.244.114")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("213.252.244.114")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("A061180b16f89099da6d34c5a3976968c19a3977c84ce0711ddfef6f7c355cac","3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "Serevalutinoffice.com" OR destinationhostname CONTAINS "orderverification-api.com" OR destinationhostname CONTAINS "Gerstaonycostumers.com" OR destinationhostname CONTAINS "authcert-ca.com" OR destinationhostname CONTAINS "ocumentssign-api.com" OR destinationhostname CONTAINS "docusigner-api.com" OR destinationhostname CONTAINS "Miyfandecompany.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "Serevalutinoffice.com" OR destinationhostname CONTAINS "orderverification-api.com" OR destinationhostname CONTAINS "Gerstaonycostumers.com" OR destinationhostname CONTAINS "authcert-ca.com" OR destinationhostname CONTAINS "ocumentssign-api.com" OR destinationhostname CONTAINS "docusigner-api.com" OR destinationhostname CONTAINS "Miyfandecompany.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "Serevalutinoffice.com" OR destinationhostname CONTAINS "orderverification-api.com" OR destinationhostname CONTAINS "Gerstaonycostumers.com" OR destinationhostname CONTAINS "authcert-ca.com" OR destinationhostname CONTAINS "ocumentssign-api.com" OR destinationhostname CONTAINS "docusigner-api.com" OR destinationhostname CONTAINS "Miyfandecompany.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://213.252.244.114/ayhtvcgcfcfrgcdxdxdrcrhj","https://cembank-api.com","https://techlog.xyz/page.icore")
index=activity AND rg_functionality="Email / Email Security" AND emailsender NOT NULL AND (emailsender CONTAINS "Russell@simpleweb-online.co.uk" OR emailsender CONTAINS "Hernandez@ubstreasury.biz" OR emailsender CONTAINS "Foster@simpleweb-online.co.uk" OR emailsender CONTAINS "Patterson@ubstreasury.biz" OR emailsender CONTAINS "Campbell@rockyourstay.net" OR emailsender CONTAINS "Henderson@fossilqwanderer.org" OR emailsender CONTAINS "Powell@onlinefundraisingtoday.org" OR emailsender CONTAINS "Evans@onlinefundraisingtoday.org" OR emailsender CONTAINS "Brooks@fossilqwanderer.org" OR emailsender CONTAINS "Edwards@sun988info.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailsender NOT NULL AND (emailsender CONTAINS "Russell@simpleweb-online.co.uk" OR emailsender CONTAINS "Hernandez@ubstreasury.biz" OR emailsender CONTAINS "Foster@simpleweb-online.co.uk" OR emailsender CONTAINS "Patterson@ubstreasury.biz" OR emailsender CONTAINS "Campbell@rockyourstay.net" OR emailsender CONTAINS "Henderson@fossilqwanderer.org" OR emailsender CONTAINS "Powell@onlinefundraisingtoday.org" OR emailsender CONTAINS "Evans@onlinefundraisingtoday.org" OR emailsender CONTAINS "Brooks@fossilqwanderer.org" OR emailsender CONTAINS "Edwards@sun988info.com")
