index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("affbad0bedccbf1812599fbce847d917","b21ad73be72280ae30d8c5556824409e","889289d9d97f7c31925a451700b4b7ac","2a7de90437c66b3f2304630c3324e2de","f14c51ca5d7afc1128cceca5d5a5694b","41320f572cdf14abc1401a72a24a621d","d38803b3f7c0faac71a3e572e9214891","5d97a32e47dfa54dd1bebde208252b88","12baeacfd0ac2d66c5959d6305a4fe50","b621005a147ef842fbc7198c8431724c","ba43e4c84da7600881ed5ccac070e001","b6ad8550dcd317a49c6e563a1188d9f0","db2db486b828182c827e4fdfc292e143","4c1777b5763bc7655d1ca89ae4774470","2357c1c6027f21094fa62a35300a96ae","28566a08334f37d7a8d244c393e9ad33","4b3eff9f394ebd2231c5c0b980c62e63","74834f29dd5d244742879c2d800e8a53","42a344fbad7a56e76c83013c677330ac","6b029fc7a0f480b7dd6158bba680e49b","5a74ea453f0b424770fdddaf470f5eae","12c97b2481efe448b93b72b80eb96563","1f993f08ed40f6b03db7f78ab8e087a5","005247fa9b312eb449150b52b38e0a4c","1f2147b2a0caeb43a9a3bcaf42808581","63ff6d1bb53cdd2d7b7fca856826c8b6","bff341b0c95eda801429a4b5c321f464","0fd264b12ea39e39da7807a117718429","af486a4e9fdc62ac31f8424a787a460c","2160629e9def4c9482b4fb642c0cd2d8","51cfd6c6390ce99979350a9a21471d30","194fb8590e1218f911870c54b5830f16","7b73a4e6e504800e256495861d0c9f78","57568755bac3f20fffb970a3c6386a43","55b6e07ff120b6c2e784c8900333aa76","bc18d787c4d886f24fa673bd2056e1ed","5be1ab1d5385d5aeadc3b498d5476761","1bc93ee0bd931d60d3cd636aa35176e3","a2fc31b9c6a23e0a5acc591e46c61618","977c52d51d44a0a9257017b72cfafab1","98e4f982363c70bd9e52e5a249fce662","7f3bd23af53c52b3e84255d7a3232111","00b9bf730dd99f43289eac1c67578852","90bfa487e9c5e8fe58263e09214e565b","2fe8262d0034349a030200390b23b453","8053b24878c4243d8eda0ccae8905ccb")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://organic.kibot.pw:2095/links/12-20","http://node.kibot.pw:2095/links/12-20","http://node.kibot.pw:2095/links/12-25","http://node.kibot.pw:8880/links/12-28","http://miix.kibot.pw:8880/links/12-28","http://node.kibot.pw:8880/links/01-13")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="195.133.18.27" AND destinationport=1234) OR (destinationaddress="195.133.18.27" AND destinationport=8080) OR (destinationaddress="195.133.18.27" AND destinationport=9997))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="195.133.18.27" AND destinationport=1234) OR (destinationaddress="195.133.18.27" AND destinationport=8080) OR (destinationaddress="195.133.18.27" AND destinationport=9997))
