index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("185.193.126.198")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("29ebf9771e52cde90776eeccd89aaf4c19577ef136258daef1a17c767ce88c9d","37a16e79e5be132d7e6c2e1ee482d80d93ad942af7110a4bc3a05f0b575236b0","5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb","9e840be4b4ab358bc3405e2c688f3ab1a9d286bd4fb9edb4468dc688962b4893","f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7","338e41f1a8be56339b039835b06d815a3666c8b0d5725b63be7bf54c8745704a")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "brian.krebsonsecurity.top" OR destinationhostname CONTAINS "brian-krebs-erectile-dysfunction.com" OR destinationhostname CONTAINS "krebsonfellatio.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "brian.krebsonsecurity.top" OR destinationhostname CONTAINS "brian-krebs-erectile-dysfunction.com" OR destinationhostname CONTAINS "krebsonfellatio.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "brian.krebsonsecurity.top" OR destinationhostname CONTAINS "brian-krebs-erectile-dysfunction.com" OR destinationhostname CONTAINS "krebsonfellatio.net")
