index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8cfad6d23b79f56fb7535a562a106f6d187f84cf","e7ef3b033c34f2ac2772c15ad53aa28599f93a51","fdb8de6f8d5f8ca6e52ce924a72b5c50ce6e5d6a","4c396041b3c8a8f5dd9db31d0f2051e23802dcd0","3552c184281abcc14e3b941841b698cfb0ec9f1d","fde012fbcc65f4ab84d5f7d4799942c3f8792cc3","e30a24e7367c4a82d283c7c68cff5739319aace9","5cc8ce82fc21add608277384dfaa8139efe8bea5","90c4223887f10f8f9c4ac61f858548d154183d9a","82f8c69a48fa1fa23ff37a0b0dc23a06a7cb6758","b330cf088ba8c75d297d4b65bdbdd8bee9a8385c","83c4a02e2d627b40c6e58bf82197e113603c4f87","508d106ea0a71f2fd360fda518e1e533e7e584ed","b5f2cc8e8580a44a6aefc08f9776516a","508d106ea0a71f2fd360fda518e1e533e7e584ed","121ea06f391d6b792b3e697191d69dc500436604")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "product2020.mrbasic.com" OR destinationhostname CONTAINS "ebook.port25.biz" OR destinationhostname CONTAINS "mert.my03.com" OR destinationhostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "product2020.mrbasic.com" OR sourcentdomain CONTAINS "ebook.port25.biz" OR sourcentdomain CONTAINS "mert.my03.com" OR sourcentdomain CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "product2020.mrbasic.com" OR sourcehostname CONTAINS "ebook.port25.biz" OR sourcehostname CONTAINS "mert.my03.com" OR sourcehostname CONTAINS "dynamic.ddns.mobi")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "product2020.mrbasic.com" OR destinationntdomain CONTAINS "ebook.port25.biz" OR destinationntdomain CONTAINS "mert.my03.com" OR destinationntdomain CONTAINS "dynamic.ddns.mobi")
