index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.138.209.197","185.183.84.197")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4ae513b6f46132aec7d1c268e6ee981af1ac0ab6d92c448c7c9bdedd63e3c303","5f19a959b36c2696ef95873017b48ab03c3ae83ecae2ea5092a30fb6179f5c7c","b0a7aa88d5db826b95a1c53e92dd19b7cfe4fb87fbd218a16d170c1644d57b0b","67ce0dbe860841a70026de673be1a5fc5062e293dbfb05564bb8eb489ce56c44")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sslcer.justdied.com" OR destinationhostname CONTAINS "jquery-dns-07.dns05.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sslcer.justdied.com" OR destinationhostname CONTAINS "jquery-dns-07.dns05.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sslcer.justdied.com" OR destinationhostname CONTAINS "jquery-dns-07.dns05.com")
