index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "se-ukr.net" OR destinationhostname CONTAINS "sb-ukr.net" OR destinationhostname CONTAINS "regs-ukr.net" OR destinationhostname CONTAINS "om-ukr.net" OR destinationhostname CONTAINS "mst-ukr.net" OR destinationhostname CONTAINS "f3-ukr.net" OR destinationhostname CONTAINS "dat1-ukr.net" OR destinationhostname CONTAINS "8-ukr.net" OR destinationhostname CONTAINS "5-ukr.net" OR destinationhostname CONTAINS "4e-ukr.net" OR destinationhostname CONTAINS "v-ukr.net" OR destinationhostname CONTAINS "verify-ukr.net" OR destinationhostname CONTAINS "v1-ukr.net" OR destinationhostname CONTAINS "tc-ukr.net" OR destinationhostname CONTAINS "signup-ukr.net" OR destinationhostname CONTAINS "score-ukr.net" OR destinationhostname CONTAINS "p3-ukr.net" OR destinationhostname CONTAINS "k-ukr.net" OR destinationhostname CONTAINS "k1-ukr.net" OR destinationhostname CONTAINS "details-ukr.net" OR destinationhostname CONTAINS "cm1-ukr.net" OR destinationhostname CONTAINS "1-ukr.net" OR destinationhostname CONTAINS "0-ukr.net" OR destinationhostname CONTAINS "uf1-ukr.net" OR destinationhostname CONTAINS "mx3-ukr.net" OR destinationhostname CONTAINS "lvc-ukr.net" OR destinationhostname CONTAINS "bnt-ukr.net" OR destinationhostname CONTAINS "private-ukr.net" OR destinationhostname CONTAINS "msx-ukr.net" OR destinationhostname CONTAINS "edisk-ukr.net" OR destinationhostname CONTAINS "cck-ukr.net" OR destinationhostname CONTAINS "news-ukr.net" OR destinationhostname CONTAINS "password-ukr.net" OR destinationhostname CONTAINS "accounts-s-ukr.net" OR destinationhostname CONTAINS "kt-ukr.net" OR destinationhostname CONTAINS "a3-ukr.net" OR destinationhostname CONTAINS "uo-ukr.net" OR destinationhostname CONTAINS "bh-ukr.net" OR destinationhostname CONTAINS "lv-ukr.net" OR destinationhostname CONTAINS "kg-ukr.net" OR destinationhostname CONTAINS "dx-ukr.net" OR destinationhostname CONTAINS "kb-ukr.net" OR destinationhostname CONTAINS "tt-ukr.net" OR destinationhostname CONTAINS "o1-ukr.net" OR destinationhostname CONTAINS "hj-ukr.net" OR destinationhostname CONTAINS "uq-ukr.net" OR destinationhostname CONTAINS "serv1-ukr.net" OR destinationhostname CONTAINS "rew-ukr.net" OR destinationhostname CONTAINS "vv-ukr.net" OR destinationhostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "se-ukr.net" OR sourcentdomain CONTAINS "sb-ukr.net" OR sourcentdomain CONTAINS "regs-ukr.net" OR sourcentdomain CONTAINS "om-ukr.net" OR sourcentdomain CONTAINS "mst-ukr.net" OR sourcentdomain CONTAINS "f3-ukr.net" OR sourcentdomain CONTAINS "dat1-ukr.net" OR sourcentdomain CONTAINS "8-ukr.net" OR sourcentdomain CONTAINS "5-ukr.net" OR sourcentdomain CONTAINS "4e-ukr.net" OR sourcentdomain CONTAINS "v-ukr.net" OR sourcentdomain CONTAINS "verify-ukr.net" OR sourcentdomain CONTAINS "v1-ukr.net" OR sourcentdomain CONTAINS "tc-ukr.net" OR sourcentdomain CONTAINS "signup-ukr.net" OR sourcentdomain CONTAINS "score-ukr.net" OR sourcentdomain CONTAINS "p3-ukr.net" OR sourcentdomain CONTAINS "k-ukr.net" OR sourcentdomain CONTAINS "k1-ukr.net" OR sourcentdomain CONTAINS "details-ukr.net" OR sourcentdomain CONTAINS "cm1-ukr.net" OR sourcentdomain CONTAINS "1-ukr.net" OR sourcentdomain CONTAINS "0-ukr.net" OR sourcentdomain CONTAINS "uf1-ukr.net" OR sourcentdomain CONTAINS "mx3-ukr.net" OR sourcentdomain CONTAINS "lvc-ukr.net" OR sourcentdomain CONTAINS "bnt-ukr.net" OR sourcentdomain CONTAINS "private-ukr.net" OR sourcentdomain CONTAINS "msx-ukr.net" OR sourcentdomain CONTAINS "edisk-ukr.net" OR sourcentdomain CONTAINS "cck-ukr.net" OR sourcentdomain CONTAINS "news-ukr.net" OR sourcentdomain CONTAINS "password-ukr.net" OR sourcentdomain CONTAINS "accounts-s-ukr.net" OR sourcentdomain CONTAINS "kt-ukr.net" OR sourcentdomain CONTAINS "a3-ukr.net" OR sourcentdomain CONTAINS "uo-ukr.net" OR sourcentdomain CONTAINS "bh-ukr.net" OR sourcentdomain CONTAINS "lv-ukr.net" OR sourcentdomain CONTAINS "kg-ukr.net" OR sourcentdomain CONTAINS "dx-ukr.net" OR sourcentdomain CONTAINS "kb-ukr.net" OR sourcentdomain CONTAINS "tt-ukr.net" OR sourcentdomain CONTAINS "o1-ukr.net" OR sourcentdomain CONTAINS "hj-ukr.net" OR sourcentdomain CONTAINS "uq-ukr.net" OR sourcentdomain CONTAINS "serv1-ukr.net" OR sourcentdomain CONTAINS "rew-ukr.net" OR sourcentdomain CONTAINS "vv-ukr.net" OR sourcentdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "se-ukr.net" OR sourcehostname CONTAINS "sb-ukr.net" OR sourcehostname CONTAINS "regs-ukr.net" OR sourcehostname CONTAINS "om-ukr.net" OR sourcehostname CONTAINS "mst-ukr.net" OR sourcehostname CONTAINS "f3-ukr.net" OR sourcehostname CONTAINS "dat1-ukr.net" OR sourcehostname CONTAINS "8-ukr.net" OR sourcehostname CONTAINS "5-ukr.net" OR sourcehostname CONTAINS "4e-ukr.net" OR sourcehostname CONTAINS "v-ukr.net" OR sourcehostname CONTAINS "verify-ukr.net" OR sourcehostname CONTAINS "v1-ukr.net" OR sourcehostname CONTAINS "tc-ukr.net" OR sourcehostname CONTAINS "signup-ukr.net" OR sourcehostname CONTAINS "score-ukr.net" OR sourcehostname CONTAINS "p3-ukr.net" OR sourcehostname CONTAINS "k-ukr.net" OR sourcehostname CONTAINS "k1-ukr.net" OR sourcehostname CONTAINS "details-ukr.net" OR sourcehostname CONTAINS "cm1-ukr.net" OR sourcehostname CONTAINS "1-ukr.net" OR sourcehostname CONTAINS "0-ukr.net" OR sourcehostname CONTAINS "uf1-ukr.net" OR sourcehostname CONTAINS "mx3-ukr.net" OR sourcehostname CONTAINS "lvc-ukr.net" OR sourcehostname CONTAINS "bnt-ukr.net" OR sourcehostname CONTAINS "private-ukr.net" OR sourcehostname CONTAINS "msx-ukr.net" OR sourcehostname CONTAINS "edisk-ukr.net" OR sourcehostname CONTAINS "cck-ukr.net" OR sourcehostname CONTAINS "news-ukr.net" OR sourcehostname CONTAINS "password-ukr.net" OR sourcehostname CONTAINS "accounts-s-ukr.net" OR sourcehostname CONTAINS "kt-ukr.net" OR sourcehostname CONTAINS "a3-ukr.net" OR sourcehostname CONTAINS "uo-ukr.net" OR sourcehostname CONTAINS "bh-ukr.net" OR sourcehostname CONTAINS "lv-ukr.net" OR sourcehostname CONTAINS "kg-ukr.net" OR sourcehostname CONTAINS "dx-ukr.net" OR sourcehostname CONTAINS "kb-ukr.net" OR sourcehostname CONTAINS "tt-ukr.net" OR sourcehostname CONTAINS "o1-ukr.net" OR sourcehostname CONTAINS "hj-ukr.net" OR sourcehostname CONTAINS "uq-ukr.net" OR sourcehostname CONTAINS "serv1-ukr.net" OR sourcehostname CONTAINS "rew-ukr.net" OR sourcehostname CONTAINS "vv-ukr.net" OR sourcehostname CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "se-ukr.net" OR destinationntdomain CONTAINS "sb-ukr.net" OR destinationntdomain CONTAINS "regs-ukr.net" OR destinationntdomain CONTAINS "om-ukr.net" OR destinationntdomain CONTAINS "mst-ukr.net" OR destinationntdomain CONTAINS "f3-ukr.net" OR destinationntdomain CONTAINS "dat1-ukr.net" OR destinationntdomain CONTAINS "8-ukr.net" OR destinationntdomain CONTAINS "5-ukr.net" OR destinationntdomain CONTAINS "4e-ukr.net" OR destinationntdomain CONTAINS "v-ukr.net" OR destinationntdomain CONTAINS "verify-ukr.net" OR destinationntdomain CONTAINS "v1-ukr.net" OR destinationntdomain CONTAINS "tc-ukr.net" OR destinationntdomain CONTAINS "signup-ukr.net" OR destinationntdomain CONTAINS "score-ukr.net" OR destinationntdomain CONTAINS "p3-ukr.net" OR destinationntdomain CONTAINS "k-ukr.net" OR destinationntdomain CONTAINS "k1-ukr.net" OR destinationntdomain CONTAINS "details-ukr.net" OR destinationntdomain CONTAINS "cm1-ukr.net" OR destinationntdomain CONTAINS "1-ukr.net" OR destinationntdomain CONTAINS "0-ukr.net" OR destinationntdomain CONTAINS "uf1-ukr.net" OR destinationntdomain CONTAINS "mx3-ukr.net" OR destinationntdomain CONTAINS "lvc-ukr.net" OR destinationntdomain CONTAINS "bnt-ukr.net" OR destinationntdomain CONTAINS "private-ukr.net" OR destinationntdomain CONTAINS "msx-ukr.net" OR destinationntdomain CONTAINS "edisk-ukr.net" OR destinationntdomain CONTAINS "cck-ukr.net" OR destinationntdomain CONTAINS "news-ukr.net" OR destinationntdomain CONTAINS "password-ukr.net" OR destinationntdomain CONTAINS "accounts-s-ukr.net" OR destinationntdomain CONTAINS "kt-ukr.net" OR destinationntdomain CONTAINS "a3-ukr.net" OR destinationntdomain CONTAINS "uo-ukr.net" OR destinationntdomain CONTAINS "bh-ukr.net" OR destinationntdomain CONTAINS "lv-ukr.net" OR destinationntdomain CONTAINS "kg-ukr.net" OR destinationntdomain CONTAINS "dx-ukr.net" OR destinationntdomain CONTAINS "kb-ukr.net" OR destinationntdomain CONTAINS "tt-ukr.net" OR destinationntdomain CONTAINS "o1-ukr.net" OR destinationntdomain CONTAINS "hj-ukr.net" OR destinationntdomain CONTAINS "uq-ukr.net" OR destinationntdomain CONTAINS "serv1-ukr.net" OR destinationntdomain CONTAINS "rew-ukr.net" OR destinationntdomain CONTAINS "vv-ukr.net" OR destinationntdomain CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "se-ukr.net" OR requesturl CONTAINS "sb-ukr.net" OR requesturl CONTAINS "regs-ukr.net" OR requesturl CONTAINS "om-ukr.net" OR requesturl CONTAINS "mst-ukr.net" OR requesturl CONTAINS "f3-ukr.net" OR requesturl CONTAINS "dat1-ukr.net" OR requesturl CONTAINS "8-ukr.net" OR requesturl CONTAINS "5-ukr.net" OR requesturl CONTAINS "4e-ukr.net" OR requesturl CONTAINS "v-ukr.net" OR requesturl CONTAINS "verify-ukr.net" OR requesturl CONTAINS "v1-ukr.net" OR requesturl CONTAINS "tc-ukr.net" OR requesturl CONTAINS "signup-ukr.net" OR requesturl CONTAINS "score-ukr.net" OR requesturl CONTAINS "p3-ukr.net" OR requesturl CONTAINS "k-ukr.net" OR requesturl CONTAINS "k1-ukr.net" OR requesturl CONTAINS "details-ukr.net" OR requesturl CONTAINS "cm1-ukr.net" OR requesturl CONTAINS "1-ukr.net" OR requesturl CONTAINS "0-ukr.net" OR requesturl CONTAINS "uf1-ukr.net" OR requesturl CONTAINS "mx3-ukr.net" OR requesturl CONTAINS "lvc-ukr.net" OR requesturl CONTAINS "bnt-ukr.net" OR requesturl CONTAINS "private-ukr.net" OR requesturl CONTAINS "msx-ukr.net" OR requesturl CONTAINS "edisk-ukr.net" OR requesturl CONTAINS "cck-ukr.net" OR requesturl CONTAINS "news-ukr.net" OR requesturl CONTAINS "password-ukr.net" OR requesturl CONTAINS "accounts-s-ukr.net" OR requesturl CONTAINS "kt-ukr.net" OR requesturl CONTAINS "a3-ukr.net" OR requesturl CONTAINS "uo-ukr.net" OR requesturl CONTAINS "bh-ukr.net" OR requesturl CONTAINS "lv-ukr.net" OR requesturl CONTAINS "kg-ukr.net" OR requesturl CONTAINS "dx-ukr.net" OR requesturl CONTAINS "kb-ukr.net" OR requesturl CONTAINS "tt-ukr.net" OR requesturl CONTAINS "o1-ukr.net" OR requesturl CONTAINS "hj-ukr.net" OR requesturl CONTAINS "uq-ukr.net" OR requesturl CONTAINS "serv1-ukr.net" OR requesturl CONTAINS "rew-ukr.net" OR requesturl CONTAINS "vv-ukr.net" OR requesturl CONTAINS "lc-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "td-ukr.net" OR destinationhostname CONTAINS "mf-ukr.net" OR destinationhostname CONTAINS "reg-ukr.net" OR destinationhostname CONTAINS "el-ukr.net" OR destinationhostname CONTAINS "acc-ukr.net" OR destinationhostname CONTAINS "login-ukr.net" OR destinationhostname CONTAINS "confirm-ukr.net" OR destinationhostname CONTAINS "accounts-ukr.net" OR destinationhostname CONTAINS "support-ukr.net" OR destinationhostname CONTAINS "numsecukr.net" OR destinationhostname CONTAINS "crv-ukr.net" OR destinationhostname CONTAINS "bld-ukr.net" OR destinationhostname CONTAINS "virtual-ukr.net" OR destinationhostname CONTAINS "settingsukr.net" OR destinationhostname CONTAINS "session-ukr.net" OR destinationhostname CONTAINS "mxukr.net" OR destinationhostname CONTAINS "dubl-ukr.net" OR destinationhostname CONTAINS "cmx-ukr.net" OR destinationhostname CONTAINS "static-ukr.net" OR destinationhostname CONTAINS "stage-ukr.net" OR destinationhostname CONTAINS "safe-ukr.net" OR destinationhostname CONTAINS "s9-ukr.net" OR destinationhostname CONTAINS "reply-ukr.net" OR destinationhostname CONTAINS "prot-ukr.net" OR destinationhostname CONTAINS "pm-kv-ukr.net" OR destinationhostname CONTAINS "mta-ukr.net" OR destinationhostname CONTAINS "mod-ukr.net" OR destinationhostname CONTAINS "ksr1-ukr.net" OR destinationhostname CONTAINS "files-ukr.net" OR destinationhostname CONTAINS "client-ukr.net" OR destinationhostname CONTAINS "clients-ukr.net" OR destinationhostname CONTAINS "web-ukr.net" OR destinationhostname CONTAINS "step-ukr.net" OR destinationhostname CONTAINS "site-ukr.net" OR destinationhostname CONTAINS "settings-ukr.net" OR destinationhostname CONTAINS "pgh-ukr.net" OR destinationhostname CONTAINS "pas-ukr.net" OR destinationhostname CONTAINS "int-ukr.net" OR destinationhostname CONTAINS "inbox-ukr.net" OR destinationhostname CONTAINS "cca-ukr.net" OR destinationhostname CONTAINS "btx-ukr.net" OR destinationhostname CONTAINS "2fa-ukr.net" OR destinationhostname CONTAINS "vh-ukr.net" OR destinationhostname CONTAINS "out-ukr.net" OR destinationhostname CONTAINS "in-ukr.net" OR destinationhostname CONTAINS "cvi-ukr.net" OR destinationhostname CONTAINS "stv-ukr.net" OR destinationhostname CONTAINS "pge-ukr.net" OR destinationhostname CONTAINS "accounts---ukr.net" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "td-ukr.net" OR sourcentdomain CONTAINS "mf-ukr.net" OR sourcentdomain CONTAINS "reg-ukr.net" OR sourcentdomain CONTAINS "el-ukr.net" OR sourcentdomain CONTAINS "acc-ukr.net" OR sourcentdomain CONTAINS "login-ukr.net" OR sourcentdomain CONTAINS "confirm-ukr.net" OR sourcentdomain CONTAINS "accounts-ukr.net" OR sourcentdomain CONTAINS "support-ukr.net" OR sourcentdomain CONTAINS "numsecukr.net" OR sourcentdomain CONTAINS "crv-ukr.net" OR sourcentdomain CONTAINS "bld-ukr.net" OR sourcentdomain CONTAINS "virtual-ukr.net" OR sourcentdomain CONTAINS "settingsukr.net" OR sourcentdomain CONTAINS "session-ukr.net" OR sourcentdomain CONTAINS "mxukr.net" OR sourcentdomain CONTAINS "dubl-ukr.net" OR sourcentdomain CONTAINS "cmx-ukr.net" OR sourcentdomain CONTAINS "static-ukr.net" OR sourcentdomain CONTAINS "stage-ukr.net" OR sourcentdomain CONTAINS "safe-ukr.net" OR sourcentdomain CONTAINS "s9-ukr.net" OR sourcentdomain CONTAINS "reply-ukr.net" OR sourcentdomain CONTAINS "prot-ukr.net" OR sourcentdomain CONTAINS "pm-kv-ukr.net" OR sourcentdomain CONTAINS "mta-ukr.net" OR sourcentdomain CONTAINS "mod-ukr.net" OR sourcentdomain CONTAINS "ksr1-ukr.net" OR sourcentdomain CONTAINS "files-ukr.net" OR sourcentdomain CONTAINS "client-ukr.net" OR sourcentdomain CONTAINS "clients-ukr.net" OR sourcentdomain CONTAINS "web-ukr.net" OR sourcentdomain CONTAINS "step-ukr.net" OR sourcentdomain CONTAINS "site-ukr.net" OR sourcentdomain CONTAINS "settings-ukr.net" OR sourcentdomain CONTAINS "pgh-ukr.net" OR sourcentdomain CONTAINS "pas-ukr.net" OR sourcentdomain CONTAINS "int-ukr.net" OR sourcentdomain CONTAINS "inbox-ukr.net" OR sourcentdomain CONTAINS "cca-ukr.net" OR sourcentdomain CONTAINS "btx-ukr.net" OR sourcentdomain CONTAINS "2fa-ukr.net" OR sourcentdomain CONTAINS "vh-ukr.net" OR sourcentdomain CONTAINS "out-ukr.net" OR sourcentdomain CONTAINS "in-ukr.net" OR sourcentdomain CONTAINS "cvi-ukr.net" OR sourcentdomain CONTAINS "stv-ukr.net" OR sourcentdomain CONTAINS "pge-ukr.net" OR sourcentdomain CONTAINS "accounts---ukr.net" OR sourcentdomain CONTAINS "")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "td-ukr.net" OR sourcehostname CONTAINS "mf-ukr.net" OR sourcehostname CONTAINS "reg-ukr.net" OR sourcehostname CONTAINS "el-ukr.net" OR sourcehostname CONTAINS "acc-ukr.net" OR sourcehostname CONTAINS "login-ukr.net" OR sourcehostname CONTAINS "confirm-ukr.net" OR sourcehostname CONTAINS "accounts-ukr.net" OR sourcehostname CONTAINS "support-ukr.net" OR sourcehostname CONTAINS "numsecukr.net" OR sourcehostname CONTAINS "crv-ukr.net" OR sourcehostname CONTAINS "bld-ukr.net" OR sourcehostname CONTAINS "virtual-ukr.net" OR sourcehostname CONTAINS "settingsukr.net" OR sourcehostname CONTAINS "session-ukr.net" OR sourcehostname CONTAINS "mxukr.net" OR sourcehostname CONTAINS "dubl-ukr.net" OR sourcehostname CONTAINS "cmx-ukr.net" OR sourcehostname CONTAINS "static-ukr.net" OR sourcehostname CONTAINS "stage-ukr.net" OR sourcehostname CONTAINS "safe-ukr.net" OR sourcehostname CONTAINS "s9-ukr.net" OR sourcehostname CONTAINS "reply-ukr.net" OR sourcehostname CONTAINS "prot-ukr.net" OR sourcehostname CONTAINS "pm-kv-ukr.net" OR sourcehostname CONTAINS "mta-ukr.net" OR sourcehostname CONTAINS "mod-ukr.net" OR sourcehostname CONTAINS "ksr1-ukr.net" OR sourcehostname CONTAINS "files-ukr.net" OR sourcehostname CONTAINS "client-ukr.net" OR sourcehostname CONTAINS "clients-ukr.net" OR sourcehostname CONTAINS "web-ukr.net" OR sourcehostname CONTAINS "step-ukr.net" OR sourcehostname CONTAINS "site-ukr.net" OR sourcehostname CONTAINS "settings-ukr.net" OR sourcehostname CONTAINS "pgh-ukr.net" OR sourcehostname CONTAINS "pas-ukr.net" OR sourcehostname CONTAINS "int-ukr.net" OR sourcehostname CONTAINS "inbox-ukr.net" OR sourcehostname CONTAINS "cca-ukr.net" OR sourcehostname CONTAINS "btx-ukr.net" OR sourcehostname CONTAINS "2fa-ukr.net" OR sourcehostname CONTAINS "vh-ukr.net" OR sourcehostname CONTAINS "out-ukr.net" OR sourcehostname CONTAINS "in-ukr.net" OR sourcehostname CONTAINS "cvi-ukr.net" OR sourcehostname CONTAINS "stv-ukr.net" OR sourcehostname CONTAINS "pge-ukr.net" OR sourcehostname CONTAINS "accounts---ukr.net" OR sourcehostname CONTAINS "")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "td-ukr.net" OR destinationntdomain CONTAINS "mf-ukr.net" OR destinationntdomain CONTAINS "reg-ukr.net" OR destinationntdomain CONTAINS "el-ukr.net" OR destinationntdomain CONTAINS "acc-ukr.net" OR destinationntdomain CONTAINS "login-ukr.net" OR destinationntdomain CONTAINS "confirm-ukr.net" OR destinationntdomain CONTAINS "accounts-ukr.net" OR destinationntdomain CONTAINS "support-ukr.net" OR destinationntdomain CONTAINS "numsecukr.net" OR destinationntdomain CONTAINS "crv-ukr.net" OR destinationntdomain CONTAINS "bld-ukr.net" OR destinationntdomain CONTAINS "virtual-ukr.net" OR destinationntdomain CONTAINS "settingsukr.net" OR destinationntdomain CONTAINS "session-ukr.net" OR destinationntdomain CONTAINS "mxukr.net" OR destinationntdomain CONTAINS "dubl-ukr.net" OR destinationntdomain CONTAINS "cmx-ukr.net" OR destinationntdomain CONTAINS "static-ukr.net" OR destinationntdomain CONTAINS "stage-ukr.net" OR destinationntdomain CONTAINS "safe-ukr.net" OR destinationntdomain CONTAINS "s9-ukr.net" OR destinationntdomain CONTAINS "reply-ukr.net" OR destinationntdomain CONTAINS "prot-ukr.net" OR destinationntdomain CONTAINS "pm-kv-ukr.net" OR destinationntdomain CONTAINS "mta-ukr.net" OR destinationntdomain CONTAINS "mod-ukr.net" OR destinationntdomain CONTAINS "ksr1-ukr.net" OR destinationntdomain CONTAINS "files-ukr.net" OR destinationntdomain CONTAINS "client-ukr.net" OR destinationntdomain CONTAINS "clients-ukr.net" OR destinationntdomain CONTAINS "web-ukr.net" OR destinationntdomain CONTAINS "step-ukr.net" OR destinationntdomain CONTAINS "site-ukr.net" OR destinationntdomain CONTAINS "settings-ukr.net" OR destinationntdomain CONTAINS "pgh-ukr.net" OR destinationntdomain CONTAINS "pas-ukr.net" OR destinationntdomain CONTAINS "int-ukr.net" OR destinationntdomain CONTAINS "inbox-ukr.net" OR destinationntdomain CONTAINS "cca-ukr.net" OR destinationntdomain CONTAINS "btx-ukr.net" OR destinationntdomain CONTAINS "2fa-ukr.net" OR destinationntdomain CONTAINS "vh-ukr.net" OR destinationntdomain CONTAINS "out-ukr.net" OR destinationntdomain CONTAINS "in-ukr.net" OR destinationntdomain CONTAINS "cvi-ukr.net" OR destinationntdomain CONTAINS "stv-ukr.net" OR destinationntdomain CONTAINS "pge-ukr.net" OR destinationntdomain CONTAINS "accounts---ukr.net" OR destinationntdomain CONTAINS "")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "td-ukr.net" OR requesturl CONTAINS "mf-ukr.net" OR requesturl CONTAINS "reg-ukr.net" OR requesturl CONTAINS "el-ukr.net" OR requesturl CONTAINS "acc-ukr.net" OR requesturl CONTAINS "login-ukr.net" OR requesturl CONTAINS "confirm-ukr.net" OR requesturl CONTAINS "accounts-ukr.net" OR requesturl CONTAINS "support-ukr.net" OR requesturl CONTAINS "numsecukr.net" OR requesturl CONTAINS "crv-ukr.net" OR requesturl CONTAINS "bld-ukr.net" OR requesturl CONTAINS "virtual-ukr.net" OR requesturl CONTAINS "settingsukr.net" OR requesturl CONTAINS "session-ukr.net" OR requesturl CONTAINS "mxukr.net" OR requesturl CONTAINS "dubl-ukr.net" OR requesturl CONTAINS "cmx-ukr.net" OR requesturl CONTAINS "static-ukr.net" OR requesturl CONTAINS "stage-ukr.net" OR requesturl CONTAINS "safe-ukr.net" OR requesturl CONTAINS "s9-ukr.net" OR requesturl CONTAINS "reply-ukr.net" OR requesturl CONTAINS "prot-ukr.net" OR requesturl CONTAINS "pm-kv-ukr.net" OR requesturl CONTAINS "mta-ukr.net" OR requesturl CONTAINS "mod-ukr.net" OR requesturl CONTAINS "ksr1-ukr.net" OR requesturl CONTAINS "files-ukr.net" OR requesturl CONTAINS "client-ukr.net" OR requesturl CONTAINS "clients-ukr.net" OR requesturl CONTAINS "web-ukr.net" OR requesturl CONTAINS "step-ukr.net" OR requesturl CONTAINS "site-ukr.net" OR requesturl CONTAINS "settings-ukr.net" OR requesturl CONTAINS "pgh-ukr.net" OR requesturl CONTAINS "pas-ukr.net" OR requesturl CONTAINS "int-ukr.net" OR requesturl CONTAINS "inbox-ukr.net" OR requesturl CONTAINS "cca-ukr.net" OR requesturl CONTAINS "btx-ukr.net" OR requesturl CONTAINS "2fa-ukr.net" OR requesturl CONTAINS "vh-ukr.net" OR requesturl CONTAINS "out-ukr.net" OR requesturl CONTAINS "in-ukr.net" OR requesturl CONTAINS "cvi-ukr.net" OR requesturl CONTAINS "stv-ukr.net" OR requesturl CONTAINS "pge-ukr.net" OR requesturl CONTAINS "accounts---ukr.net" OR requesturl CONTAINS "")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "changepassword-ukr.net" OR destinationhostname CONTAINS "accounts--ukr.net" OR destinationhostname CONTAINS "uc-ukr.net" OR destinationhostname CONTAINS "ub-ukr.net" OR destinationhostname CONTAINS "ck-ukr.net" OR destinationhostname CONTAINS "kv-ukr.net" OR destinationhostname CONTAINS "k1v-ukr.net" OR destinationhostname CONTAINS "vn-ukr.net" OR destinationhostname CONTAINS "ser-ukr.net" OR destinationhostname CONTAINS "p-ukr.net" OR destinationhostname CONTAINS "lt-ukr.net" OR destinationhostname CONTAINS "ml-ukr.net" OR destinationhostname CONTAINS "m1-ukr.net" OR destinationhostname CONTAINS "u1-ukr.net" OR destinationhostname CONTAINS "l-ukr.net" OR destinationhostname CONTAINS "mail-ukr.net" OR destinationhostname CONTAINS "conf-ukr.net" OR destinationhostname CONTAINS "account-ukr.net" OR destinationhostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "changepassword-ukr.net" OR sourcentdomain CONTAINS "accounts--ukr.net" OR sourcentdomain CONTAINS "uc-ukr.net" OR sourcentdomain CONTAINS "ub-ukr.net" OR sourcentdomain CONTAINS "ck-ukr.net" OR sourcentdomain CONTAINS "kv-ukr.net" OR sourcentdomain CONTAINS "k1v-ukr.net" OR sourcentdomain CONTAINS "vn-ukr.net" OR sourcentdomain CONTAINS "ser-ukr.net" OR sourcentdomain CONTAINS "p-ukr.net" OR sourcentdomain CONTAINS "lt-ukr.net" OR sourcentdomain CONTAINS "ml-ukr.net" OR sourcentdomain CONTAINS "m1-ukr.net" OR sourcentdomain CONTAINS "u1-ukr.net" OR sourcentdomain CONTAINS "l-ukr.net" OR sourcentdomain CONTAINS "mail-ukr.net" OR sourcentdomain CONTAINS "conf-ukr.net" OR sourcentdomain CONTAINS "account-ukr.net" OR sourcentdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "changepassword-ukr.net" OR sourcehostname CONTAINS "accounts--ukr.net" OR sourcehostname CONTAINS "uc-ukr.net" OR sourcehostname CONTAINS "ub-ukr.net" OR sourcehostname CONTAINS "ck-ukr.net" OR sourcehostname CONTAINS "kv-ukr.net" OR sourcehostname CONTAINS "k1v-ukr.net" OR sourcehostname CONTAINS "vn-ukr.net" OR sourcehostname CONTAINS "ser-ukr.net" OR sourcehostname CONTAINS "p-ukr.net" OR sourcehostname CONTAINS "lt-ukr.net" OR sourcehostname CONTAINS "ml-ukr.net" OR sourcehostname CONTAINS "m1-ukr.net" OR sourcehostname CONTAINS "u1-ukr.net" OR sourcehostname CONTAINS "l-ukr.net" OR sourcehostname CONTAINS "mail-ukr.net" OR sourcehostname CONTAINS "conf-ukr.net" OR sourcehostname CONTAINS "account-ukr.net" OR sourcehostname CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "changepassword-ukr.net" OR destinationntdomain CONTAINS "accounts--ukr.net" OR destinationntdomain CONTAINS "uc-ukr.net" OR destinationntdomain CONTAINS "ub-ukr.net" OR destinationntdomain CONTAINS "ck-ukr.net" OR destinationntdomain CONTAINS "kv-ukr.net" OR destinationntdomain CONTAINS "k1v-ukr.net" OR destinationntdomain CONTAINS "vn-ukr.net" OR destinationntdomain CONTAINS "ser-ukr.net" OR destinationntdomain CONTAINS "p-ukr.net" OR destinationntdomain CONTAINS "lt-ukr.net" OR destinationntdomain CONTAINS "ml-ukr.net" OR destinationntdomain CONTAINS "m1-ukr.net" OR destinationntdomain CONTAINS "u1-ukr.net" OR destinationntdomain CONTAINS "l-ukr.net" OR destinationntdomain CONTAINS "mail-ukr.net" OR destinationntdomain CONTAINS "conf-ukr.net" OR destinationntdomain CONTAINS "account-ukr.net" OR destinationntdomain CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "changepassword-ukr.net" OR requesturl CONTAINS "accounts--ukr.net" OR requesturl CONTAINS "uc-ukr.net" OR requesturl CONTAINS "ub-ukr.net" OR requesturl CONTAINS "ck-ukr.net" OR requesturl CONTAINS "kv-ukr.net" OR requesturl CONTAINS "k1v-ukr.net" OR requesturl CONTAINS "vn-ukr.net" OR requesturl CONTAINS "ser-ukr.net" OR requesturl CONTAINS "p-ukr.net" OR requesturl CONTAINS "lt-ukr.net" OR requesturl CONTAINS "ml-ukr.net" OR requesturl CONTAINS "m1-ukr.net" OR requesturl CONTAINS "u1-ukr.net" OR requesturl CONTAINS "l-ukr.net" OR requesturl CONTAINS "mail-ukr.net" OR requesturl CONTAINS "conf-ukr.net" OR requesturl CONTAINS "account-ukr.net" OR requesturl CONTAINS "notify-ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("45.9.148.178","45.9.148.83")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Microsoft Windows" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Microsoft Windows" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Microsoft Windows" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Content Management System" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Network Access Control / NAC" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Network Access Control / NAC" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Network Access Control / NAC" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Virtualization / Containers" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Virtualization / Containers" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Virtualization / Containers" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Privileged User" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Privileged User" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Privileged User" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Identity Management" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Identity Management" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Identity Management" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Identity Access Management" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Identity Access Management" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Identity Access Management" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / WiFi" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / WiFi" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / WiFi" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://accounts.cm1-ukr.net/desktop/security/login/","http://accounts.regs-ukr.net/desktop/security/login/")
