index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("67af0bc97b3ea18025a88a0b0201c18d","f6591c1ab7f7b782c386af1b6c2c0e9b","986c8c6ee6f6a9d12a54cf84ad9b853a","2183043b19f4707f987d874ce44389e3","77d507d30a155cf315f839db3bf507f7","8d52407e143823a867c6c8330cdcb91a","73cdd1be414dec81c6e42b83f0d04f20","7e9f28cedfa8b012ab8646ac341a841c","8cf601c06370612010f438fa8faa8aa7","e2753e9bc7e5880a365f035cdc5f6e77","205e6247f5a0dce8a55910354c816a61","e13adb67739f4b485544ed99bc29f618","f3bdcd409063a42479dbb162dc7f5d21","fce1b5ffcaefd1dcb130f4e11cdb488d","a66338d9ba331efa4918e2d6397b17fe","40dc8989d4b2e3db0a9e98ef7082b0d9","b69eb0155df920514d4ae8d44316d05a","285b5f246f994b4650475db5143e4987","7e1a2828650e707d8142d526604f4061","83b66aae624690e82c8e011e615bce59","5f3dd0514c98bab7172a4ccb2f7a152d","1fdb1dd742674d3939f636c3fc4b761f","493aaca456d7d453520caed5d62fdc00","493aaca456d7d453520caed5d62fdc00","7727070eb8c69773cafb09ce77492c27","f7d53946b3ae7322cd018480a2f47de8","10cf4d43163ee395ddad1fe7e777e2c9","f222524766456936074f513cec2149a8","d6f84855f212400314fb72d673aba27b","62ba55ac729763037da1836b46cb84bc","3c5905da1f3aecd2dccc05f6b76a1ca9","ce1f3b789b2aab2b2b833343f13b7c98","371a2eb2800bb2beccc1a975f3073594","7abca4faa3609f86f89f1a32fe7bbcc6","e8a7e8bb090da018b96aab3a66c7adeb","5d9464aba77e1830e1cf8d6b6e14aa55","71a6ba713f3f5c8e24c965487a86b5d4","93abe2fcb964ec91de7d75c52d676d2d","2c3de1cefe5cd2a5315a9c9970277bd7","69c7d9025fa3841c4cd69db1353179cf","7871587d8de06edc81c163564ea4ea41","10b6e46e1d4052b2ad07834604339b57","5eeda9bfb83aacb9c3f805f5a2d41f3b","5f3dd0514c98bab7172a4ccb2f7a152d","493aaca456d7d453520caed5d62fdc00","87562e70e958c0a0e13646f558a85d04","8f7dfbec116017d632ca77be578795fd","5dcf26e3fbce71902b0cd7c72c60545b","523613a7b9dfa398cbd5ebd2dd0f4f38","d76e1525c8998795867a17ed33573552")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("5d93629fbc80fed017e1657392a28df4","e9cb6a37c43e0393d4c656bc9f6bf556","705e5d7328ae381c5063590b4f5198da","b81577dbe375dbc1d1349d8704737adf")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://sinmaxinter.top:7001/services.zip","http://sinmaxinter.top:7001/c3-server25.zip","http://14.19.214.36:6666/pp.exe","http://14.19.214.36/aa.aspx","http://14.19.214.36/fscan.exe","http://14.19.214.36/ew.exe","http://14.19.214.36/11.exe","http://14.19.214.36/ringq.exe","http://45.130.22.219/aspx.exe","http://192.210.206.76/srdi.dat")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="14.19.214.36" AND destinationport=6666 OR destinationaddress="14.19.214.36" AND destinationport=3333 OR destinationaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="14.19.214.36" AND sourceport=6666 OR sourceaddress="14.19.214.36" AND sourceport=3333 OR sourceaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="14.19.214.36" AND sourceport=6666 OR translatedipaddress="14.19.214.36" AND sourceport=3333 OR translatedipaddress="1.119.3.28" AND sourceport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND destinationtranslatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND destinationtranslatedport=7455)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="14.19.214.36" AND translatedport=6666 OR destinationtranslatedaddress="14.19.214.36" AND translatedport=3333 OR destinationtranslatedaddress="1.119.3.28" AND translatedport=7455)
