index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("ea30afd4f65f8866bebcaf92168f3241","1192697ed3d2302bec3ee828c154e300","1db93cb95e409769561efb66e4fd5c72","6e9001516053770f6dd645954240bced","a978aec11a072855e2cfba593160886e","4f1661d873cef8a3fa3ca34080816e87","20ac8a45d129e3ce3444494d9672692c","5c1ad4a8335fc406040a070b2be661ff","90948ae9f7d167d4016c7a56477a67b3","1932d2e4081f6dd5c8b32d29b1ab5caf","e4cc1a7f992909e8509520fdd6c9a3f7","bb497b86c26893e10432781c6550e5fc","254784ca05bdd3928d7889d0ea3195ab","5f89f90efd1568618e72bb30b8e44fce","5aa60757665510b2c8e9bb924c2b40ef")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://46.41.150.129/.bo/am","http://46.41.150.129/.bo/nw","http://46.41.150.129/.js/new-xmrig.tgz","http://2.58.149.237:6972/hoze","http://2.58.149.237:6972/xri2.tar","http://141.95.19.91:8080/xri/xri","http://141.95.19.91:8080/xri/config.json")
