index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("103.119.44.100","103.119.44.93","103.119.44.152")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e52af19dce25d51f9cf258613988b8edc583f7c7e134d3e1b834d9aab9c7c4c4","dc026cd76891d1f84f44f6789ac0145a458e2c704a7bc50590ec08966578edb3","cb450f82c49eadd597a87645f9f30c52c03c6ed9425386af5b321664fe3a6da0","210990e36122e0facc7c74373569f052fa0651ab06644330fe00b685793ee0fd","34f37327a0154d644854a723e0557c733931e2366a19bdb4cfe6f6ae6770c50f","ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56","b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65","72cd668d9bc442f522556807390d4f7e32966bef20ef1a831bf36a5ab213191e","1cabdb7ab1cbd0526498d15839c780850a41a8c917b65581fad9e7dbdedd5e0f","5453911d6f597d65ab542ec25723a7d87b2292c2e2a52a40d3a32032f6117acd","826d07108a1223140e6a58b44722404009ac2e82df0acfd7d1f5bf29b56526b6","337841b5ade52ba853a30eb8ab04dede64d89808893fb6e04122479502951528","17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734")
