index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("40b428899db353bb0ea244d95b5b82d9","4ea6cee3ecd9bbd2faf3af73059736df","070f0390aad17883cc8fad2dc8bc81ba","b841d27fb7fee74142be38cee917eda5")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sk5621.com.co")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sk5621.com.co")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sk5621.com.co")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="45.77.71.50" AND destinationport=8082))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="45.77.71.50" AND destinationport=8082))
