index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5249c568fb2746786504b049bbd5d9c8","97713132e4ea03422d3915bab1c42074","174A0FED20987D1E2ED5DB9B1019E49B","27626f2c3667fab9e103f32e2af11e84")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kvaladrigrosdrom.top" OR destinationhostname CONTAINS "scellapreambulus.top" OR destinationhostname CONTAINS "lbegardingstorque.com" OR destinationhostname CONTAINS "kerymarynicegross.top" OR destinationhostname CONTAINS "pillygreamstronh.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kvaladrigrosdrom.top" OR destinationhostname CONTAINS "scellapreambulus.top" OR destinationhostname CONTAINS "lbegardingstorque.com" OR destinationhostname CONTAINS "kerymarynicegross.top" OR destinationhostname CONTAINS "pillygreamstronh.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kvaladrigrosdrom.top" OR destinationhostname CONTAINS "scellapreambulus.top" OR destinationhostname CONTAINS "lbegardingstorque.com" OR destinationhostname CONTAINS "kerymarynicegross.top" OR destinationhostname CONTAINS "pillygreamstronh.com")
