index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("173.232.146.118")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac","426ba2acf51641fb23c2efe686ad31d6398c3dd25c2c62f6ba0621455a3f7178","4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "r2gttyb5vqu6swf5.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "r2gttyb5vqu6swf5.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "r2gttyb5vqu6swf5.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://173.232.146.118/Bnyar8RsK04ug/")
