index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("28e9b06e5a4606c9d806092a8ad78ce2ea7aa1077a08bcf3ec1d8e3d19714f08","dfbe48ade0b70bd999abaf68469438f528b0e108e767ef3a99249a4a8cfa0176","41dbb7871093a6be9acc7327bc7a7757df2f157912ff5649b01390307283bb53","163ef20a1c69bcb29f436ebf1e8a8a2b6ab6887fc48bfacd843a77b7144948b9","de263e5ad81bb5e2be7d57c7e201fe172108d987562a98897736d8c9235661a2","67bb4acf52cc57f62f84161e068e254dba6b4058c04a5d707c057492bd208659","b22e47e11ff7aefc271bff1cbd2c904d8c4208f494208357a949242f6926dfc9","1b2909eda77c14b559b06a68a794868989b7e38c9ca185a3180c63e5c38622b5","f17b64733fa1ba60dda283bd4f6e6ce74fc921028e95c4c1a2079be39084085e","0d3b0dc5ea6643d36d745fcaa177eba88200b2b16596111e140f59092070594f","ba518af59262e878d31c71020ebfcbd50dfadf1e7c47a340003c80284681794e")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="194.145.227.21" AND destinationport=5443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="194.145.227.21" AND destinationport=5443))
