index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "ca-central-1.awsplatform.online" OR destinationhostname CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationhostname CONTAINS "central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationhostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationhostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationhostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationhostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationhostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationhostname CONTAINS "us-east-console.awsplatform.online" OR destinationhostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationhostname CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationhostname CONTAINS "us-west-1.ua-aws.army" OR destinationhostname CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationhostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationhostname CONTAINS "zero-trust.solutions" OR destinationhostname CONTAINS "ukrtelecom.cloud" OR destinationhostname CONTAINS "awsplatform.online" OR destinationhostname CONTAINS "aws-ukraine.cloud" OR destinationhostname CONTAINS "aws-s3.cloud" OR destinationhostname CONTAINS "aws-meet.cloud" OR destinationhostname CONTAINS "aws-il.cloud" OR destinationhostname CONTAINS "aws-data.cloud" OR destinationhostname CONTAINS "aws-meetings.cloud" OR destinationhostname CONTAINS "aws-secure.cloud" OR destinationhostname CONTAINS "aws-join.cloud" OR destinationhostname CONTAINS "aws-online.cloud" OR destinationhostname CONTAINS "gov-au.cloud" OR destinationhostname CONTAINS "gov-aws.cloud" OR destinationhostname CONTAINS "gov-fi.cloud" OR destinationhostname CONTAINS "gov-gr.cloud" OR destinationhostname CONTAINS "gov-lt.cloud" OR destinationhostname CONTAINS "gov-lv.cloud" OR destinationhostname CONTAINS "gov-pl.cloud" OR destinationhostname CONTAINS "gov-sk.cloud" OR destinationhostname CONTAINS "gov-trust.cloud" OR destinationhostname CONTAINS "gov-ua.cloud" OR destinationhostname CONTAINS "govps.cloud" OR destinationhostname CONTAINS "govtr.cloud" OR destinationhostname CONTAINS "govua.cloud" OR destinationhostname CONTAINS "eru-gov.cloud" OR destinationhostname CONTAINS "feedzai-gov.cloud" OR destinationhostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "ca-central-1.awsplatform.online" OR sourcentdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcentdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcentdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcentdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcentdomain CONTAINS "us-east-console.awsplatform.online" OR sourcentdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcentdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcentdomain CONTAINS "us-west-1.ua-aws.army" OR sourcentdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcentdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcentdomain CONTAINS "zero-trust.solutions" OR sourcentdomain CONTAINS "ukrtelecom.cloud" OR sourcentdomain CONTAINS "awsplatform.online" OR sourcentdomain CONTAINS "aws-ukraine.cloud" OR sourcentdomain CONTAINS "aws-s3.cloud" OR sourcentdomain CONTAINS "aws-meet.cloud" OR sourcentdomain CONTAINS "aws-il.cloud" OR sourcentdomain CONTAINS "aws-data.cloud" OR sourcentdomain CONTAINS "aws-meetings.cloud" OR sourcentdomain CONTAINS "aws-secure.cloud" OR sourcentdomain CONTAINS "aws-join.cloud" OR sourcentdomain CONTAINS "aws-online.cloud" OR sourcentdomain CONTAINS "gov-au.cloud" OR sourcentdomain CONTAINS "gov-aws.cloud" OR sourcentdomain CONTAINS "gov-fi.cloud" OR sourcentdomain CONTAINS "gov-gr.cloud" OR sourcentdomain CONTAINS "gov-lt.cloud" OR sourcentdomain CONTAINS "gov-lv.cloud" OR sourcentdomain CONTAINS "gov-pl.cloud" OR sourcentdomain CONTAINS "gov-sk.cloud" OR sourcentdomain CONTAINS "gov-trust.cloud" OR sourcentdomain CONTAINS "gov-ua.cloud" OR sourcentdomain CONTAINS "govps.cloud" OR sourcentdomain CONTAINS "govtr.cloud" OR sourcentdomain CONTAINS "govua.cloud" OR sourcentdomain CONTAINS "eru-gov.cloud" OR sourcentdomain CONTAINS "feedzai-gov.cloud" OR sourcentdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "ca-central-1.awsplatform.online" OR sourcehostname CONTAINS "ca-west-1.mfa-gov.cloud" OR sourcehostname CONTAINS "central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-central-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "eu-central-2-aws.ua-aws.army" OR sourcehostname CONTAINS "eu-north-1-aws.ua-energy.cloud" OR sourcehostname CONTAINS "eu-north-1-aws.ua-gov.cloud" OR sourcehostname CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.govtr.cloud" OR sourcehostname CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR sourcehostname CONTAINS "us-east-1-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "us-east-2-aws.ua-gov.cloud" OR sourcehostname CONTAINS "us-east-console.awsplatform.online" OR sourcehostname CONTAINS "us-west-1-amazon.ua-energy.cloud" OR sourcehostname CONTAINS "us-west-1.aws-ukraine.cloud" OR sourcehostname CONTAINS "us-west-1.ua-aws.army" OR sourcehostname CONTAINS "us-west-1.ukrtelecom.cloud" OR sourcehostname CONTAINS "us-west-2-aws.mfa-gov.cloud" OR sourcehostname CONTAINS "zero-trust.solutions" OR sourcehostname CONTAINS "ukrtelecom.cloud" OR sourcehostname CONTAINS "awsplatform.online" OR sourcehostname CONTAINS "aws-ukraine.cloud" OR sourcehostname CONTAINS "aws-s3.cloud" OR sourcehostname CONTAINS "aws-meet.cloud" OR sourcehostname CONTAINS "aws-il.cloud" OR sourcehostname CONTAINS "aws-data.cloud" OR sourcehostname CONTAINS "aws-meetings.cloud" OR sourcehostname CONTAINS "aws-secure.cloud" OR sourcehostname CONTAINS "aws-join.cloud" OR sourcehostname CONTAINS "aws-online.cloud" OR sourcehostname CONTAINS "gov-au.cloud" OR sourcehostname CONTAINS "gov-aws.cloud" OR sourcehostname CONTAINS "gov-fi.cloud" OR sourcehostname CONTAINS "gov-gr.cloud" OR sourcehostname CONTAINS "gov-lt.cloud" OR sourcehostname CONTAINS "gov-lv.cloud" OR sourcehostname CONTAINS "gov-pl.cloud" OR sourcehostname CONTAINS "gov-sk.cloud" OR sourcehostname CONTAINS "gov-trust.cloud" OR sourcehostname CONTAINS "gov-ua.cloud" OR sourcehostname CONTAINS "govps.cloud" OR sourcehostname CONTAINS "govtr.cloud" OR sourcehostname CONTAINS "govua.cloud" OR sourcehostname CONTAINS "eru-gov.cloud" OR sourcehostname CONTAINS "feedzai-gov.cloud" OR sourcehostname CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "ca-central-1.awsplatform.online" OR destinationntdomain CONTAINS "ca-west-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-central-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "eu-central-2-aws.ua-aws.army" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-energy.cloud" OR destinationntdomain CONTAINS "eu-north-1-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.govtr.cloud" OR destinationntdomain CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR destinationntdomain CONTAINS "us-east-1-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "us-east-2-aws.ua-gov.cloud" OR destinationntdomain CONTAINS "us-east-console.awsplatform.online" OR destinationntdomain CONTAINS "us-west-1-amazon.ua-energy.cloud" OR destinationntdomain CONTAINS "us-west-1.aws-ukraine.cloud" OR destinationntdomain CONTAINS "us-west-1.ua-aws.army" OR destinationntdomain CONTAINS "us-west-1.ukrtelecom.cloud" OR destinationntdomain CONTAINS "us-west-2-aws.mfa-gov.cloud" OR destinationntdomain CONTAINS "zero-trust.solutions" OR destinationntdomain CONTAINS "ukrtelecom.cloud" OR destinationntdomain CONTAINS "awsplatform.online" OR destinationntdomain CONTAINS "aws-ukraine.cloud" OR destinationntdomain CONTAINS "aws-s3.cloud" OR destinationntdomain CONTAINS "aws-meet.cloud" OR destinationntdomain CONTAINS "aws-il.cloud" OR destinationntdomain CONTAINS "aws-data.cloud" OR destinationntdomain CONTAINS "aws-meetings.cloud" OR destinationntdomain CONTAINS "aws-secure.cloud" OR destinationntdomain CONTAINS "aws-join.cloud" OR destinationntdomain CONTAINS "aws-online.cloud" OR destinationntdomain CONTAINS "gov-au.cloud" OR destinationntdomain CONTAINS "gov-aws.cloud" OR destinationntdomain CONTAINS "gov-fi.cloud" OR destinationntdomain CONTAINS "gov-gr.cloud" OR destinationntdomain CONTAINS "gov-lt.cloud" OR destinationntdomain CONTAINS "gov-lv.cloud" OR destinationntdomain CONTAINS "gov-pl.cloud" OR destinationntdomain CONTAINS "gov-sk.cloud" OR destinationntdomain CONTAINS "gov-trust.cloud" OR destinationntdomain CONTAINS "gov-ua.cloud" OR destinationntdomain CONTAINS "govps.cloud" OR destinationntdomain CONTAINS "govtr.cloud" OR destinationntdomain CONTAINS "govua.cloud" OR destinationntdomain CONTAINS "eru-gov.cloud" OR destinationntdomain CONTAINS "feedzai-gov.cloud" OR destinationntdomain CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "ca-central-1.awsplatform.online" OR requesturl CONTAINS "ca-west-1.mfa-gov.cloud" OR requesturl CONTAINS "central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-central-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.mfa-gov.cloud" OR requesturl CONTAINS "eu-central-1.ukrtelecom.cloud" OR requesturl CONTAINS "eu-central-2-aws.ua-aws.army" OR requesturl CONTAINS "eu-north-1-aws.ua-energy.cloud" OR requesturl CONTAINS "eu-north-1-aws.ua-gov.cloud" OR requesturl CONTAINS "eu-south-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-south-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.gov-ua.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.govtr.cloud" OR requesturl CONTAINS "eu-southeast-1-aws.zero-trust.solutions" OR requesturl CONTAINS "us-east-1-aws.mfa-gov.cloud" OR requesturl CONTAINS "us-east-2-aws.ua-gov.cloud" OR requesturl CONTAINS "us-east-console.awsplatform.online" OR requesturl CONTAINS "us-west-1-amazon.ua-energy.cloud" OR requesturl CONTAINS "us-west-1.aws-ukraine.cloud" OR requesturl CONTAINS "us-west-1.ua-aws.army" OR requesturl CONTAINS "us-west-1.ukrtelecom.cloud" OR requesturl CONTAINS "us-west-2-aws.mfa-gov.cloud" OR requesturl CONTAINS "zero-trust.solutions" OR requesturl CONTAINS "ukrtelecom.cloud" OR requesturl CONTAINS "awsplatform.online" OR requesturl CONTAINS "aws-ukraine.cloud" OR requesturl CONTAINS "aws-s3.cloud" OR requesturl CONTAINS "aws-meet.cloud" OR requesturl CONTAINS "aws-il.cloud" OR requesturl CONTAINS "aws-data.cloud" OR requesturl CONTAINS "aws-meetings.cloud" OR requesturl CONTAINS "aws-secure.cloud" OR requesturl CONTAINS "aws-join.cloud" OR requesturl CONTAINS "aws-online.cloud" OR requesturl CONTAINS "gov-au.cloud" OR requesturl CONTAINS "gov-aws.cloud" OR requesturl CONTAINS "gov-fi.cloud" OR requesturl CONTAINS "gov-gr.cloud" OR requesturl CONTAINS "gov-lt.cloud" OR requesturl CONTAINS "gov-lv.cloud" OR requesturl CONTAINS "gov-pl.cloud" OR requesturl CONTAINS "gov-sk.cloud" OR requesturl CONTAINS "gov-trust.cloud" OR requesturl CONTAINS "gov-ua.cloud" OR requesturl CONTAINS "govps.cloud" OR requesturl CONTAINS "govtr.cloud" OR requesturl CONTAINS "govua.cloud" OR requesturl CONTAINS "eru-gov.cloud" OR requesturl CONTAINS "feedzai-gov.cloud" OR requesturl CONTAINS "md-gov.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "mf-gov.cloud" OR destinationhostname CONTAINS "mo-gov.cloud" OR destinationhostname CONTAINS "mpo-gov.cloud" OR destinationhostname CONTAINS "mpsv-gov.cloud" OR destinationhostname CONTAINS "msmt-gov.cloud" OR destinationhostname CONTAINS "mv-gov.cloud" OR destinationhostname CONTAINS "my-gov.cloud" OR destinationhostname CONTAINS "mzd-gov.cloud" OR destinationhostname CONTAINS "mze-gov.cloud" OR destinationhostname CONTAINS "mzp-gov.cloud" OR destinationhostname CONTAINS "mzv-gov.cloud" OR destinationhostname CONTAINS "nakit-gov.cloud" OR destinationhostname CONTAINS "nbu-gov.cloud" OR destinationhostname CONTAINS "nukib-gov.cloud" OR destinationhostname CONTAINS "police-gov.cloud" OR destinationhostname CONTAINS "mmr-gov.cloud" OR destinationhostname CONTAINS "uohs-gov.cloud" OR destinationhostname CONTAINS "uoou-gov.cloud" OR destinationhostname CONTAINS "vlada-gov.cloud" OR destinationhostname CONTAINS "voa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-il.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mfa-gov-tr.cloud" OR destinationhostname CONTAINS "mil-be.cloud" OR destinationhostname CONTAINS "mil-ee.cloud" OR destinationhostname CONTAINS "mil-pl.cloud" OR destinationhostname CONTAINS "mil-pt.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "mod-gov-il.cloud" OR destinationhostname CONTAINS "s3-acronis.cloud" OR destinationhostname CONTAINS "s3-army.cloud" OR destinationhostname CONTAINS "s3-atlassian.cloud" OR destinationhostname CONTAINS "s3-aws.cloud" OR destinationhostname CONTAINS "s3-bah.cloud" OR destinationhostname CONTAINS "s3-be.cloud" OR destinationhostname CONTAINS "s3-blackberry.cloud" OR destinationhostname CONTAINS "s3-csis.cloud" OR destinationhostname CONTAINS "s3-de.cloud" OR destinationhostname CONTAINS "s3-dgap.cloud" OR destinationhostname CONTAINS "s3-dk.cloud" OR destinationhostname CONTAINS "s3-dnc.cloud" OR destinationhostname CONTAINS "s3-esa.cloud" OR destinationhostname CONTAINS "s3-fbi.cloud" OR destinationhostname CONTAINS "s3-hudson.cloud" OR destinationhostname CONTAINS "s3-ida.cloud" OR destinationhostname CONTAINS "s3-iri.cloud" OR destinationhostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "mf-gov.cloud" OR sourcentdomain CONTAINS "mo-gov.cloud" OR sourcentdomain CONTAINS "mpo-gov.cloud" OR sourcentdomain CONTAINS "mpsv-gov.cloud" OR sourcentdomain CONTAINS "msmt-gov.cloud" OR sourcentdomain CONTAINS "mv-gov.cloud" OR sourcentdomain CONTAINS "my-gov.cloud" OR sourcentdomain CONTAINS "mzd-gov.cloud" OR sourcentdomain CONTAINS "mze-gov.cloud" OR sourcentdomain CONTAINS "mzp-gov.cloud" OR sourcentdomain CONTAINS "mzv-gov.cloud" OR sourcentdomain CONTAINS "nakit-gov.cloud" OR sourcentdomain CONTAINS "nbu-gov.cloud" OR sourcentdomain CONTAINS "nukib-gov.cloud" OR sourcentdomain CONTAINS "police-gov.cloud" OR sourcentdomain CONTAINS "mmr-gov.cloud" OR sourcentdomain CONTAINS "uohs-gov.cloud" OR sourcentdomain CONTAINS "uoou-gov.cloud" OR sourcentdomain CONTAINS "vlada-gov.cloud" OR sourcentdomain CONTAINS "voa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-il.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mfa-gov-tr.cloud" OR sourcentdomain CONTAINS "mil-be.cloud" OR sourcentdomain CONTAINS "mil-ee.cloud" OR sourcentdomain CONTAINS "mil-pl.cloud" OR sourcentdomain CONTAINS "mil-pt.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "mod-gov-il.cloud" OR sourcentdomain CONTAINS "s3-acronis.cloud" OR sourcentdomain CONTAINS "s3-army.cloud" OR sourcentdomain CONTAINS "s3-atlassian.cloud" OR sourcentdomain CONTAINS "s3-aws.cloud" OR sourcentdomain CONTAINS "s3-bah.cloud" OR sourcentdomain CONTAINS "s3-be.cloud" OR sourcentdomain CONTAINS "s3-blackberry.cloud" OR sourcentdomain CONTAINS "s3-csis.cloud" OR sourcentdomain CONTAINS "s3-de.cloud" OR sourcentdomain CONTAINS "s3-dgap.cloud" OR sourcentdomain CONTAINS "s3-dk.cloud" OR sourcentdomain CONTAINS "s3-dnc.cloud" OR sourcentdomain CONTAINS "s3-esa.cloud" OR sourcentdomain CONTAINS "s3-fbi.cloud" OR sourcentdomain CONTAINS "s3-hudson.cloud" OR sourcentdomain CONTAINS "s3-ida.cloud" OR sourcentdomain CONTAINS "s3-iri.cloud" OR sourcentdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "mf-gov.cloud" OR sourcehostname CONTAINS "mo-gov.cloud" OR sourcehostname CONTAINS "mpo-gov.cloud" OR sourcehostname CONTAINS "mpsv-gov.cloud" OR sourcehostname CONTAINS "msmt-gov.cloud" OR sourcehostname CONTAINS "mv-gov.cloud" OR sourcehostname CONTAINS "my-gov.cloud" OR sourcehostname CONTAINS "mzd-gov.cloud" OR sourcehostname CONTAINS "mze-gov.cloud" OR sourcehostname CONTAINS "mzp-gov.cloud" OR sourcehostname CONTAINS "mzv-gov.cloud" OR sourcehostname CONTAINS "nakit-gov.cloud" OR sourcehostname CONTAINS "nbu-gov.cloud" OR sourcehostname CONTAINS "nukib-gov.cloud" OR sourcehostname CONTAINS "police-gov.cloud" OR sourcehostname CONTAINS "mmr-gov.cloud" OR sourcehostname CONTAINS "uohs-gov.cloud" OR sourcehostname CONTAINS "uoou-gov.cloud" OR sourcehostname CONTAINS "vlada-gov.cloud" OR sourcehostname CONTAINS "voa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-il.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mfa-gov-tr.cloud" OR sourcehostname CONTAINS "mil-be.cloud" OR sourcehostname CONTAINS "mil-ee.cloud" OR sourcehostname CONTAINS "mil-pl.cloud" OR sourcehostname CONTAINS "mil-pt.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "mod-gov-il.cloud" OR sourcehostname CONTAINS "s3-acronis.cloud" OR sourcehostname CONTAINS "s3-army.cloud" OR sourcehostname CONTAINS "s3-atlassian.cloud" OR sourcehostname CONTAINS "s3-aws.cloud" OR sourcehostname CONTAINS "s3-bah.cloud" OR sourcehostname CONTAINS "s3-be.cloud" OR sourcehostname CONTAINS "s3-blackberry.cloud" OR sourcehostname CONTAINS "s3-csis.cloud" OR sourcehostname CONTAINS "s3-de.cloud" OR sourcehostname CONTAINS "s3-dgap.cloud" OR sourcehostname CONTAINS "s3-dk.cloud" OR sourcehostname CONTAINS "s3-dnc.cloud" OR sourcehostname CONTAINS "s3-esa.cloud" OR sourcehostname CONTAINS "s3-fbi.cloud" OR sourcehostname CONTAINS "s3-hudson.cloud" OR sourcehostname CONTAINS "s3-ida.cloud" OR sourcehostname CONTAINS "s3-iri.cloud" OR sourcehostname CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "mf-gov.cloud" OR destinationntdomain CONTAINS "mo-gov.cloud" OR destinationntdomain CONTAINS "mpo-gov.cloud" OR destinationntdomain CONTAINS "mpsv-gov.cloud" OR destinationntdomain CONTAINS "msmt-gov.cloud" OR destinationntdomain CONTAINS "mv-gov.cloud" OR destinationntdomain CONTAINS "my-gov.cloud" OR destinationntdomain CONTAINS "mzd-gov.cloud" OR destinationntdomain CONTAINS "mze-gov.cloud" OR destinationntdomain CONTAINS "mzp-gov.cloud" OR destinationntdomain CONTAINS "mzv-gov.cloud" OR destinationntdomain CONTAINS "nakit-gov.cloud" OR destinationntdomain CONTAINS "nbu-gov.cloud" OR destinationntdomain CONTAINS "nukib-gov.cloud" OR destinationntdomain CONTAINS "police-gov.cloud" OR destinationntdomain CONTAINS "mmr-gov.cloud" OR destinationntdomain CONTAINS "uohs-gov.cloud" OR destinationntdomain CONTAINS "uoou-gov.cloud" OR destinationntdomain CONTAINS "vlada-gov.cloud" OR destinationntdomain CONTAINS "voa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-il.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mfa-gov-tr.cloud" OR destinationntdomain CONTAINS "mil-be.cloud" OR destinationntdomain CONTAINS "mil-ee.cloud" OR destinationntdomain CONTAINS "mil-pl.cloud" OR destinationntdomain CONTAINS "mil-pt.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "mod-gov-il.cloud" OR destinationntdomain CONTAINS "s3-acronis.cloud" OR destinationntdomain CONTAINS "s3-army.cloud" OR destinationntdomain CONTAINS "s3-atlassian.cloud" OR destinationntdomain CONTAINS "s3-aws.cloud" OR destinationntdomain CONTAINS "s3-bah.cloud" OR destinationntdomain CONTAINS "s3-be.cloud" OR destinationntdomain CONTAINS "s3-blackberry.cloud" OR destinationntdomain CONTAINS "s3-csis.cloud" OR destinationntdomain CONTAINS "s3-de.cloud" OR destinationntdomain CONTAINS "s3-dgap.cloud" OR destinationntdomain CONTAINS "s3-dk.cloud" OR destinationntdomain CONTAINS "s3-dnc.cloud" OR destinationntdomain CONTAINS "s3-esa.cloud" OR destinationntdomain CONTAINS "s3-fbi.cloud" OR destinationntdomain CONTAINS "s3-hudson.cloud" OR destinationntdomain CONTAINS "s3-ida.cloud" OR destinationntdomain CONTAINS "s3-iri.cloud" OR destinationntdomain CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "mf-gov.cloud" OR requesturl CONTAINS "mo-gov.cloud" OR requesturl CONTAINS "mpo-gov.cloud" OR requesturl CONTAINS "mpsv-gov.cloud" OR requesturl CONTAINS "msmt-gov.cloud" OR requesturl CONTAINS "mv-gov.cloud" OR requesturl CONTAINS "my-gov.cloud" OR requesturl CONTAINS "mzd-gov.cloud" OR requesturl CONTAINS "mze-gov.cloud" OR requesturl CONTAINS "mzp-gov.cloud" OR requesturl CONTAINS "mzv-gov.cloud" OR requesturl CONTAINS "nakit-gov.cloud" OR requesturl CONTAINS "nbu-gov.cloud" OR requesturl CONTAINS "nukib-gov.cloud" OR requesturl CONTAINS "police-gov.cloud" OR requesturl CONTAINS "mmr-gov.cloud" OR requesturl CONTAINS "uohs-gov.cloud" OR requesturl CONTAINS "uoou-gov.cloud" OR requesturl CONTAINS "vlada-gov.cloud" OR requesturl CONTAINS "voa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-il.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mfa-gov-tr.cloud" OR requesturl CONTAINS "mil-be.cloud" OR requesturl CONTAINS "mil-ee.cloud" OR requesturl CONTAINS "mil-pl.cloud" OR requesturl CONTAINS "mil-pt.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "mod-gov-il.cloud" OR requesturl CONTAINS "s3-acronis.cloud" OR requesturl CONTAINS "s3-army.cloud" OR requesturl CONTAINS "s3-atlassian.cloud" OR requesturl CONTAINS "s3-aws.cloud" OR requesturl CONTAINS "s3-bah.cloud" OR requesturl CONTAINS "s3-be.cloud" OR requesturl CONTAINS "s3-blackberry.cloud" OR requesturl CONTAINS "s3-csis.cloud" OR requesturl CONTAINS "s3-de.cloud" OR requesturl CONTAINS "s3-dgap.cloud" OR requesturl CONTAINS "s3-dk.cloud" OR requesturl CONTAINS "s3-dnc.cloud" OR requesturl CONTAINS "s3-esa.cloud" OR requesturl CONTAINS "s3-fbi.cloud" OR requesturl CONTAINS "s3-hudson.cloud" OR requesturl CONTAINS "s3-ida.cloud" OR requesturl CONTAINS "s3-iri.cloud" OR requesturl CONTAINS "s3-knowbe4.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "s3-marcus.cloud" OR destinationhostname CONTAINS "s3-monitoring.cloud" OR destinationhostname CONTAINS "s3-nato.cloud" OR destinationhostname CONTAINS "s3-ned.cloud" OR destinationhostname CONTAINS "s3-nsa.cloud" OR destinationhostname CONTAINS "s3-proofpoint.cloud" OR destinationhostname CONTAINS "s3-pt.cloud" OR destinationhostname CONTAINS "s3-rackspace.cloud" OR destinationhostname CONTAINS "s3-rand.cloud" OR destinationhostname CONTAINS "s3-spacex.cloud" OR destinationhostname CONTAINS "s3-state.cloud" OR destinationhostname CONTAINS "s3-stig.cloud" OR destinationhostname CONTAINS "s3-ua.cloud" OR destinationhostname CONTAINS "s3-ucia.cloud" OR destinationhostname CONTAINS "s3-zoho.cloud" OR destinationhostname CONTAINS "ua-aws.army" OR destinationhostname CONTAINS "ua-energy.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-gov.cloud" OR destinationhostname CONTAINS "ua-mil.cloud" OR destinationhostname CONTAINS "ua-sec.cloud" OR destinationhostname CONTAINS "ua-se.cloud" OR destinationhostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "s3-marcus.cloud" OR sourcentdomain CONTAINS "s3-monitoring.cloud" OR sourcentdomain CONTAINS "s3-nato.cloud" OR sourcentdomain CONTAINS "s3-ned.cloud" OR sourcentdomain CONTAINS "s3-nsa.cloud" OR sourcentdomain CONTAINS "s3-proofpoint.cloud" OR sourcentdomain CONTAINS "s3-pt.cloud" OR sourcentdomain CONTAINS "s3-rackspace.cloud" OR sourcentdomain CONTAINS "s3-rand.cloud" OR sourcentdomain CONTAINS "s3-spacex.cloud" OR sourcentdomain CONTAINS "s3-state.cloud" OR sourcentdomain CONTAINS "s3-stig.cloud" OR sourcentdomain CONTAINS "s3-ua.cloud" OR sourcentdomain CONTAINS "s3-ucia.cloud" OR sourcentdomain CONTAINS "s3-zoho.cloud" OR sourcentdomain CONTAINS "ua-aws.army" OR sourcentdomain CONTAINS "ua-energy.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-gov.cloud" OR sourcentdomain CONTAINS "ua-mil.cloud" OR sourcentdomain CONTAINS "ua-sec.cloud" OR sourcentdomain CONTAINS "ua-se.cloud" OR sourcentdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "s3-marcus.cloud" OR sourcehostname CONTAINS "s3-monitoring.cloud" OR sourcehostname CONTAINS "s3-nato.cloud" OR sourcehostname CONTAINS "s3-ned.cloud" OR sourcehostname CONTAINS "s3-nsa.cloud" OR sourcehostname CONTAINS "s3-proofpoint.cloud" OR sourcehostname CONTAINS "s3-pt.cloud" OR sourcehostname CONTAINS "s3-rackspace.cloud" OR sourcehostname CONTAINS "s3-rand.cloud" OR sourcehostname CONTAINS "s3-spacex.cloud" OR sourcehostname CONTAINS "s3-state.cloud" OR sourcehostname CONTAINS "s3-stig.cloud" OR sourcehostname CONTAINS "s3-ua.cloud" OR sourcehostname CONTAINS "s3-ucia.cloud" OR sourcehostname CONTAINS "s3-zoho.cloud" OR sourcehostname CONTAINS "ua-aws.army" OR sourcehostname CONTAINS "ua-energy.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-gov.cloud" OR sourcehostname CONTAINS "ua-mil.cloud" OR sourcehostname CONTAINS "ua-sec.cloud" OR sourcehostname CONTAINS "ua-se.cloud" OR sourcehostname CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "s3-marcus.cloud" OR destinationntdomain CONTAINS "s3-monitoring.cloud" OR destinationntdomain CONTAINS "s3-nato.cloud" OR destinationntdomain CONTAINS "s3-ned.cloud" OR destinationntdomain CONTAINS "s3-nsa.cloud" OR destinationntdomain CONTAINS "s3-proofpoint.cloud" OR destinationntdomain CONTAINS "s3-pt.cloud" OR destinationntdomain CONTAINS "s3-rackspace.cloud" OR destinationntdomain CONTAINS "s3-rand.cloud" OR destinationntdomain CONTAINS "s3-spacex.cloud" OR destinationntdomain CONTAINS "s3-state.cloud" OR destinationntdomain CONTAINS "s3-stig.cloud" OR destinationntdomain CONTAINS "s3-ua.cloud" OR destinationntdomain CONTAINS "s3-ucia.cloud" OR destinationntdomain CONTAINS "s3-zoho.cloud" OR destinationntdomain CONTAINS "ua-aws.army" OR destinationntdomain CONTAINS "ua-energy.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-gov.cloud" OR destinationntdomain CONTAINS "ua-mil.cloud" OR destinationntdomain CONTAINS "ua-sec.cloud" OR destinationntdomain CONTAINS "ua-se.cloud" OR destinationntdomain CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "s3-marcus.cloud" OR requesturl CONTAINS "s3-monitoring.cloud" OR requesturl CONTAINS "s3-nato.cloud" OR requesturl CONTAINS "s3-ned.cloud" OR requesturl CONTAINS "s3-nsa.cloud" OR requesturl CONTAINS "s3-proofpoint.cloud" OR requesturl CONTAINS "s3-pt.cloud" OR requesturl CONTAINS "s3-rackspace.cloud" OR requesturl CONTAINS "s3-rand.cloud" OR requesturl CONTAINS "s3-spacex.cloud" OR requesturl CONTAINS "s3-state.cloud" OR requesturl CONTAINS "s3-stig.cloud" OR requesturl CONTAINS "s3-ua.cloud" OR requesturl CONTAINS "s3-ucia.cloud" OR requesturl CONTAINS "s3-zoho.cloud" OR requesturl CONTAINS "ua-aws.army" OR requesturl CONTAINS "ua-energy.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-gov.cloud" OR requesturl CONTAINS "ua-mil.cloud" OR requesturl CONTAINS "ua-sec.cloud" OR requesturl CONTAINS "ua-se.cloud" OR requesturl CONTAINS "ua-sn.cloud")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("38.180.110.238","179.43.148.82","45.11.230.105","45.141.58.60","95.217.113.133","185.187.155.74","141.195.117.125","185.76.79.178","2.58.201.112","89.46.234.115","84.32.188.193","38.180.146.210","84.32.188.197","45.80.193.9","45.67.85.40","45.134.111.123","84.32.188.153","62.72.7.213","93.188.163.16","23.160.56.122","95.156.207.121","84.32.188.148","166.0.187.233","185.216.72.196","38.180.146.230","84.32.188.200","45.11.231.8","162.252.175.233","179.43.163.18","46.19.141.186","193.29.59.9","135.181.130.232","45.134.110.83","185.187.155.73","23.160.56.100")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Content Management System" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Microsoft Windows" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Microsoft Windows" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Microsoft Windows" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Services / Applications" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Services / Applications" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / VPN" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / VPN" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / VPN" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Content Management System" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Network Access Control / NAC" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Network Access Control / NAC" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Virtualization / Containers" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Virtualization / Containers" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Privileged User" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Privileged User" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Privileged User" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Identity Management" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Identity Management" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Access / Identity Management" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Identity Access Management" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Identity Access Management" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Identity Access Management" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / WiFi" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / WiFi" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a5de73d69c1a7fbae2e71b98d48fe9b5","34c88cd591f73bc47a1a0fe2a4f594f628be98ad2366eeb4e467595115d8505a","8bcb741a204c25232a11a7084aa2221f","071276e907f185d9e341d549b198e60741e2c7f8d64dd2ca2c5d88d50b2c6ffc","86f58115c891ce91b7364e5ff0314b31","6e6680786fa5b023cf301b6bc5faaa89c86dc34b696f4b078cf22b1b353d5d3c","80b3cad4f70b6ea8924aa13d2730328b","31f2cc1157248aec5135147073e49406d057bebf78b3361dd7cbb6e37708fbcc","c0da30b71d58e071fc5863381444d9f0","88fd6a36e8a61597dd71755b985e5fcd0b8308b69fc0f4b0fc7960fb80018622","1595266bb78dc1e3d67f929154824c74","b8327671ebc20db6f09efc4f19bd8c39d9e28c9a37bdd15b2fd62ade208d2e8a","222c83d156a41735c38cc552a7084a86","a5bbb109faefcecba695a84a737f5e47fa418cea39d654bb512a6f4a0b148758","fa9af43e9bbb55b7512b369084d91f4d","5534cc837ba4fa3726322883449b3e97ca3e0d28c0ccf468b868397fdfa44e0b","281a28800a4ba744bfde7b4aff46f24e","b9ab481e7a9a92cfa2d53de8e7a3c75287cff6a3374f4202ec16ea9e03d80a0b","d37cd2c462af0e0643076b20c5ff561e","18a078a976734c9ec562f5dfa3f5904ef5d37000fb8c1f5bd0dc2dee47203bf9","e465a4191a93195094a803e5d4703a90","bb4d5a3f7a40c895882b73e1aca8c71ea40cef6c4f6732bec36e6342f6e2487a","3f753810430b26b94a172fbf816e7d76","ef4bd88ec5e8b401594b22632fd05e401658cf78de681f81409eadf93f412ebd","434ffae8cfc3caa370be2e69ffaa95d1","1cfe29f214d1177b66aec2b0d039fec47dd94c751fa95d34bc5da3bbab02213a","c287c05d91a19796b2649ebebd27394b","3a2496db64507311f5fbd3aba0228b653f673fc2152a267a1386cbab33798db5","aabbfd1acd3f3a2212e348f2d6f169fc","984082823dc1f122a1bb505700c25b27332f54942496814dfd0c68de0eba59dc","b0a0ad4093e781a278541e4b01daa7a8","383e63f40aecdd508e1790a8b7535e41b06b3f6984bb417218ca96e554b1164b","a18a1cad9df5b409963601c8e30669e4","296d446cb2ad93255c45a2d4b674bbacb6d1581a94cf6bb5e54df5a742502680","cbbc4903da831b6f1dc39d0c8d3fc413","129ba064dfd9981575c00419ee9df1c7711679abc974fa4086076ebc3dc964f5","bd711dc427e17cc724f288cc5c3b0842","f2acb92d0793d066e9414bc9e0369bd3ffa047b40720fe3bd3f2c0875d17a1cb","b38e7e8bba44bc5619b2689024ad9fca","f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8","40f957b756096fa6b80f95334ba92034","280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0","db326d934e386059cc56c4e61695128e","8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5","f58cf55b944f5942f1d120d95140b800")
