index=activity AND rg_functionality="Email / Email Security" AND emailsenderdomain NOT NULL AND (emailsenderdomain CONTAINS "finrar-reporting.org" OR emailsenderdomain CONTAINS "Finpro-finrar.org" OR emailsenderdomain CONTAINS "gateway2-finra.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailsenderdomain NOT NULL AND (emailsenderdomain CONTAINS "finrar-reporting.org" OR emailsenderdomain CONTAINS "Finpro-finrar.org" OR emailsenderdomain CONTAINS "gateway2-finra.org")
index=activity AND rg_functionality="Email / Email Security" AND emailrecipientdomain NOT NULL AND (emailrecipientdomain CONTAINS "finrar-reporting.org" OR emailrecipientdomain CONTAINS "Finpro-finrar.org" OR emailrecipientdomain CONTAINS "gateway2-finra.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailrecipientdomain NOT NULL AND (emailrecipientdomain CONTAINS "finrar-reporting.org" OR emailrecipientdomain CONTAINS "Finpro-finrar.org" OR emailrecipientdomain CONTAINS "gateway2-finra.org")
