index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "crowdstrike.phpartners.org" OR destinationhostname CONTAINS "crowdstrike0day.com" OR destinationhostname CONTAINS "crowdstrikebluescreen.com" OR destinationhostname CONTAINS "crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeupdate.com" OR destinationhostname CONTAINS "crowdstrikebsod.com" OR destinationhostname CONTAINS "www.crowdstrike0day.com" OR destinationhostname CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "www.microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikeodayl.com" OR destinationhostname CONTAINS "crowdstrike.buzz" OR destinationhostname CONTAINS "www.crowdstriketoken.com" OR destinationhostname CONTAINS "www.crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationhostname CONTAINS "microsoftcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikedoomsday.com" OR destinationhostname CONTAINS "crowdstrikedown.com" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "crowdstrike-helpdesk.com" OR destinationhostname CONTAINS "crowdstrikefix.com" OR destinationhostname CONTAINS "fix-crowdstrike-bsod.com" OR destinationhostname CONTAINS "crowdstrikedown.site" OR destinationhostname CONTAINS "crowdstuck.org" OR destinationhostname CONTAINS "crowdfalcon-immed-update.com" OR destinationhostname CONTAINS "crowdstriketoken.com" OR destinationhostname CONTAINS "crowdstrikeclaim.com" OR destinationhostname CONTAINS "crowdstrikeblueteam.com" OR destinationhostname CONTAINS "crowdstrikefix.zip" OR destinationhostname CONTAINS "crowdstrikereport.com" OR destinationhostname CONTAINS "iscrowdstrikefixed.com" OR destinationhostname CONTAINS "iscrowdstrikestilldown.com" OR destinationhostname CONTAINS "crowdstrikeoutage.info" OR destinationhostname CONTAINS "whatiscrowdstrike.com" OR destinationhostname CONTAINS "isitcrowdstrike.com" OR destinationhostname CONTAINS "crowdstrikefail.com" OR destinationhostname CONTAINS "crowdstrikeoopsie.com" OR destinationhostname CONTAINS "crowdstrike.fail" OR destinationhostname CONTAINS "crowdstruck.us" OR destinationhostname CONTAINS "crowdstruck.me" OR destinationhostname CONTAINS "howtofixcrowdstrikeissue.com" OR destinationhostname CONTAINS "www.fix-crowdstrike.com" OR destinationhostname CONTAINS "crowdstrokeme.me" OR destinationhostname CONTAINS "www.crowdstrikeswag.com" OR destinationhostname CONTAINS "spain.crowdstrikebenefits.com" OR destinationhostname CONTAINS "us.crowdstrikebenefits.com" OR destinationhostname CONTAINS "japan.crowdstrikebenefits.com" OR destinationhostname CONTAINS "pay.crowdstrikecure.com" OR destinationhostname CONTAINS "pay.crowdstrife.com" OR destinationhostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "crowdstrike.phpartners.org" OR sourcentdomain CONTAINS "crowdstrike0day.com" OR sourcentdomain CONTAINS "crowdstrikebluescreen.com" OR sourcentdomain CONTAINS "crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeupdate.com" OR sourcentdomain CONTAINS "crowdstrikebsod.com" OR sourcentdomain CONTAINS "www.crowdstrike0day.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "www.microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikeodayl.com" OR sourcentdomain CONTAINS "crowdstrike.buzz" OR sourcentdomain CONTAINS "www.crowdstriketoken.com" OR sourcentdomain CONTAINS "www.crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcentdomain CONTAINS "microsoftcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikedoomsday.com" OR sourcentdomain CONTAINS "crowdstrikedown.com" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrike-helpdesk.com" OR sourcentdomain CONTAINS "crowdstrikefix.com" OR sourcentdomain CONTAINS "fix-crowdstrike-bsod.com" OR sourcentdomain CONTAINS "crowdstrikedown.site" OR sourcentdomain CONTAINS "crowdstuck.org" OR sourcentdomain CONTAINS "crowdfalcon-immed-update.com" OR sourcentdomain CONTAINS "crowdstriketoken.com" OR sourcentdomain CONTAINS "crowdstrikeclaim.com" OR sourcentdomain CONTAINS "crowdstrikeblueteam.com" OR sourcentdomain CONTAINS "crowdstrikefix.zip" OR sourcentdomain CONTAINS "crowdstrikereport.com" OR sourcentdomain CONTAINS "iscrowdstrikefixed.com" OR sourcentdomain CONTAINS "iscrowdstrikestilldown.com" OR sourcentdomain CONTAINS "crowdstrikeoutage.info" OR sourcentdomain CONTAINS "whatiscrowdstrike.com" OR sourcentdomain CONTAINS "isitcrowdstrike.com" OR sourcentdomain CONTAINS "crowdstrikefail.com" OR sourcentdomain CONTAINS "crowdstrikeoopsie.com" OR sourcentdomain CONTAINS "crowdstrike.fail" OR sourcentdomain CONTAINS "crowdstruck.us" OR sourcentdomain CONTAINS "crowdstruck.me" OR sourcentdomain CONTAINS "howtofixcrowdstrikeissue.com" OR sourcentdomain CONTAINS "www.fix-crowdstrike.com" OR sourcentdomain CONTAINS "crowdstrokeme.me" OR sourcentdomain CONTAINS "www.crowdstrikeswag.com" OR sourcentdomain CONTAINS "spain.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "us.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "japan.crowdstrikebenefits.com" OR sourcentdomain CONTAINS "pay.crowdstrikecure.com" OR sourcentdomain CONTAINS "pay.crowdstrife.com" OR sourcentdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "crowdstrike.phpartners.org" OR sourcehostname CONTAINS "crowdstrike0day.com" OR sourcehostname CONTAINS "crowdstrikebluescreen.com" OR sourcehostname CONTAINS "crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeupdate.com" OR sourcehostname CONTAINS "crowdstrikebsod.com" OR sourcehostname CONTAINS "www.crowdstrike0day.com" OR sourcehostname CONTAINS "www.fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "www.microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikeodayl.com" OR sourcehostname CONTAINS "crowdstrike.buzz" OR sourcehostname CONTAINS "www.crowdstriketoken.com" OR sourcehostname CONTAINS "www.crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-apocalypse.com" OR sourcehostname CONTAINS "microsoftcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikedoomsday.com" OR sourcehostname CONTAINS "crowdstrikedown.com" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "crowdstrike-helpdesk.com" OR sourcehostname CONTAINS "crowdstrikefix.com" OR sourcehostname CONTAINS "fix-crowdstrike-bsod.com" OR sourcehostname CONTAINS "crowdstrikedown.site" OR sourcehostname CONTAINS "crowdstuck.org" OR sourcehostname CONTAINS "crowdfalcon-immed-update.com" OR sourcehostname CONTAINS "crowdstriketoken.com" OR sourcehostname CONTAINS "crowdstrikeclaim.com" OR sourcehostname CONTAINS "crowdstrikeblueteam.com" OR sourcehostname CONTAINS "crowdstrikefix.zip" OR sourcehostname CONTAINS "crowdstrikereport.com" OR sourcehostname CONTAINS "iscrowdstrikefixed.com" OR sourcehostname CONTAINS "iscrowdstrikestilldown.com" OR sourcehostname CONTAINS "crowdstrikeoutage.info" OR sourcehostname CONTAINS "whatiscrowdstrike.com" OR sourcehostname CONTAINS "isitcrowdstrike.com" OR sourcehostname CONTAINS "crowdstrikefail.com" OR sourcehostname CONTAINS "crowdstrikeoopsie.com" OR sourcehostname CONTAINS "crowdstrike.fail" OR sourcehostname CONTAINS "crowdstruck.us" OR sourcehostname CONTAINS "crowdstruck.me" OR sourcehostname CONTAINS "howtofixcrowdstrikeissue.com" OR sourcehostname CONTAINS "www.fix-crowdstrike.com" OR sourcehostname CONTAINS "crowdstrokeme.me" OR sourcehostname CONTAINS "www.crowdstrikeswag.com" OR sourcehostname CONTAINS "spain.crowdstrikebenefits.com" OR sourcehostname CONTAINS "us.crowdstrikebenefits.com" OR sourcehostname CONTAINS "japan.crowdstrikebenefits.com" OR sourcehostname CONTAINS "pay.crowdstrikecure.com" OR sourcehostname CONTAINS "pay.crowdstrife.com" OR sourcehostname CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "crowdstrike.phpartners.org" OR destinationntdomain CONTAINS "crowdstrike0day.com" OR destinationntdomain CONTAINS "crowdstrikebluescreen.com" OR destinationntdomain CONTAINS "crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeupdate.com" OR destinationntdomain CONTAINS "crowdstrikebsod.com" OR destinationntdomain CONTAINS "www.crowdstrike0day.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "www.microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikeodayl.com" OR destinationntdomain CONTAINS "crowdstrike.buzz" OR destinationntdomain CONTAINS "www.crowdstriketoken.com" OR destinationntdomain CONTAINS "www.crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-apocalypse.com" OR destinationntdomain CONTAINS "microsoftcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikedoomsday.com" OR destinationntdomain CONTAINS "crowdstrikedown.com" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrike-helpdesk.com" OR destinationntdomain CONTAINS "crowdstrikefix.com" OR destinationntdomain CONTAINS "fix-crowdstrike-bsod.com" OR destinationntdomain CONTAINS "crowdstrikedown.site" OR destinationntdomain CONTAINS "crowdstuck.org" OR destinationntdomain CONTAINS "crowdfalcon-immed-update.com" OR destinationntdomain CONTAINS "crowdstriketoken.com" OR destinationntdomain CONTAINS "crowdstrikeclaim.com" OR destinationntdomain CONTAINS "crowdstrikeblueteam.com" OR destinationntdomain CONTAINS "crowdstrikefix.zip" OR destinationntdomain CONTAINS "crowdstrikereport.com" OR destinationntdomain CONTAINS "iscrowdstrikefixed.com" OR destinationntdomain CONTAINS "iscrowdstrikestilldown.com" OR destinationntdomain CONTAINS "crowdstrikeoutage.info" OR destinationntdomain CONTAINS "whatiscrowdstrike.com" OR destinationntdomain CONTAINS "isitcrowdstrike.com" OR destinationntdomain CONTAINS "crowdstrikefail.com" OR destinationntdomain CONTAINS "crowdstrikeoopsie.com" OR destinationntdomain CONTAINS "crowdstrike.fail" OR destinationntdomain CONTAINS "crowdstruck.us" OR destinationntdomain CONTAINS "crowdstruck.me" OR destinationntdomain CONTAINS "howtofixcrowdstrikeissue.com" OR destinationntdomain CONTAINS "www.fix-crowdstrike.com" OR destinationntdomain CONTAINS "crowdstrokeme.me" OR destinationntdomain CONTAINS "www.crowdstrikeswag.com" OR destinationntdomain CONTAINS "spain.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "us.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "japan.crowdstrikebenefits.com" OR destinationntdomain CONTAINS "pay.crowdstrikecure.com" OR destinationntdomain CONTAINS "pay.crowdstrife.com" OR destinationntdomain CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "crowdstrike.phpartners.org" OR requesturl CONTAINS "crowdstrike0day.com" OR requesturl CONTAINS "crowdstrikebluescreen.com" OR requesturl CONTAINS "crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeupdate.com" OR requesturl CONTAINS "crowdstrikebsod.com" OR requesturl CONTAINS "www.crowdstrike0day.com" OR requesturl CONTAINS "www.fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "www.microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikeodayl.com" OR requesturl CONTAINS "crowdstrike.buzz" OR requesturl CONTAINS "www.crowdstriketoken.com" OR requesturl CONTAINS "www.crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-apocalypse.com" OR requesturl CONTAINS "microsoftcrowdstrike.com" OR requesturl CONTAINS "crowdstrikedoomsday.com" OR requesturl CONTAINS "crowdstrikedown.com" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "crowdstrike-helpdesk.com" OR requesturl CONTAINS "crowdstrikefix.com" OR requesturl CONTAINS "fix-crowdstrike-bsod.com" OR requesturl CONTAINS "crowdstrikedown.site" OR requesturl CONTAINS "crowdstuck.org" OR requesturl CONTAINS "crowdfalcon-immed-update.com" OR requesturl CONTAINS "crowdstriketoken.com" OR requesturl CONTAINS "crowdstrikeclaim.com" OR requesturl CONTAINS "crowdstrikeblueteam.com" OR requesturl CONTAINS "crowdstrikefix.zip" OR requesturl CONTAINS "crowdstrikereport.com" OR requesturl CONTAINS "iscrowdstrikefixed.com" OR requesturl CONTAINS "iscrowdstrikestilldown.com" OR requesturl CONTAINS "crowdstrikeoutage.info" OR requesturl CONTAINS "whatiscrowdstrike.com" OR requesturl CONTAINS "isitcrowdstrike.com" OR requesturl CONTAINS "crowdstrikefail.com" OR requesturl CONTAINS "crowdstrikeoopsie.com" OR requesturl CONTAINS "crowdstrike.fail" OR requesturl CONTAINS "crowdstruck.us" OR requesturl CONTAINS "crowdstruck.me" OR requesturl CONTAINS "howtofixcrowdstrikeissue.com" OR requesturl CONTAINS "www.fix-crowdstrike.com" OR requesturl CONTAINS "crowdstrokeme.me" OR requesturl CONTAINS "www.crowdstrikeswag.com" OR requesturl CONTAINS "spain.crowdstrikebenefits.com" OR requesturl CONTAINS "us.crowdstrikebenefits.com" OR requesturl CONTAINS "japan.crowdstrikebenefits.com" OR requesturl CONTAINS "pay.crowdstrikecure.com" OR requesturl CONTAINS "pay.crowdstrife.com" OR requesturl CONTAINS "pay.crowdstrikerecovery.com")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("52.219.116.113","185.199.110.153","185.230.63.171","185.199.108.153","172.67.216.164","3.33.251.168","104.21.67.233","198.185.159.145","104.21.19.9","104.21.45.162","52.219.121.66","207.171.166.22","185.199.111.153","34.149.87.45","185.199.222.21","13.248.243.5","185.199.109.153","3.33.130.190","192.64.119.170","35.81.42.29","185.53.177.53","34.102.136.180","172.67.220.94","52.219.220.138","15.197.148.33","198.185.159.144","172.67.182.125","54.68.181.161","212.1.210.95","104.247.81.53","104.21.20.201","99.83.213.230","104.21.75.98","20.38.122.68","67.4.148.242","172.67.184.97","75.2.87.65","172.67.206.221","52.88.12.134","89.117.139.195","208.91.197.24","104.16.180.118","52.219.193.130","172.67.158.135","184.168.221.59","15.197.225.128","76.76.21.22","104.21.14.88","34.215.111.121","199.59.243.225","20.60.132.100","192.64.119.34","76.223.105.230","91.195.240.19","3.5.160.162","80.78.22.84","104.18.211.105","54.84.104.245","104.18.19.37")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Content Management System" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Microsoft Windows" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Microsoft Windows" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Microsoft Windows" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Services / Applications" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Services / Applications" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / VPN" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / VPN" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / VPN" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Content Management System" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Network Access Control / NAC" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Network Access Control / NAC" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Virtualization / Containers" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Virtualization / Containers" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Privileged User" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Privileged User" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Privileged User" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Identity Management" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Identity Management" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Access / Identity Management" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Identity Access Management" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Identity Access Management" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Identity Access Management" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / WiFi" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / WiFi" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2","5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9","4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0","52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006","835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299","b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3","b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628","6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2","931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6","be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349","48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="213.5.130.58" AND sourceport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND destinationtranslatedport=443)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="213.5.130.58" AND translatedport=443)
