index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("F3772A23595C0B51AE32D8E7D601ACBE530C7E97","95889E0EF3D31367583DD31FB5F25743FE92D81D","EE0678E58868EBD6603CC2E06A134680D2012C1B","1F862B89CC5557F8309A6739DF30DC4AB0865668193FDFF70BA93F05D4F8C8B8")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://amnestyhk.org/ss/defaultaa.html","https://amnestyhk.org/ss/4ba29d5b72266b28.html","https://amnestyhk.org/ss/mac.js","https://amnestyhk.org/ss/server.enc")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="88.218.192.128" AND destinationport=5633) OR (
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="88.218.192.128" AND destinationport=5633) OR (
