index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("41CDCEC8311F735E1ED8D3BAB9192173","06B5A67BF37FED5B92C2211F342D7F0A","C676EB09E74308A879658FDA6FCB74FC","31A5973AFABF2FEBE9690F20AC045973","FD7555A617420B42BA946FCC5248D07F","53C5FCDD09A53BAE6C21E0CADD85AEC2","46417AD0FC33783C298B7441ACED2C1A","157C6E86D68D98F777D37C3753322F69","E05AF60FBB3EC9110ACBF38CD1071F52","931A598836097496F21443AE864D160B","021C535B8E70E9EFA74512DB647EF011","04F9B8DDD038E3D3DA3AB54AEBE73687","08B9C6AEFF78A30BE44694BB650EC198","0A1C6D9CD67172995D22FA54946662F0","15AE0E6E5B449797F4080E1E9A1ECC3F","17CB582F64A32C584DF68AEEF23E25F6","3DA30534B377B01CCAA3BF25F93AF1BA","3E3EC6645D75ED83C0C57E3151917B96","3FCFE20A4D3C5CD07944328DF25C81C2","457101EA5C30C53F9381D7E9AA6432A4","78EA0072E01F9BEC53D414C2CAD7C497","84D68E7B3AACF245D0C60F94A8D0AC4A","8736492918F8836D13DEFC6525540610","9120216CAE280E802FA22AB29A346119","92A0947B1A2CB8CFD645ED585E2001D1","A52E4EEB2BF7F1BFDAC3E3C0673ECE5F","A8169881B8552852F0D117FDD743F5E0","B426CE9179226681043CE8ED3ABCA862","BDF4DEF26EFBF676BB020B4BE49F9011","BEC908D62554CD16BD857A692BEF6FC6","C004DC680A8B74B3C99137A73AFE46D7","C7E1B92397E1C563E9FAA222CBF39BE7","DEF6F71E3A21F99F9494A4CB1D8D4279","F6DE9D853EF1B802FC1EF34BD0787ABA","FFCEF12B4AB6DE46454D9AFA1E55379E","5ACF14897F3EFFF3D60AEE7A76C4753D","34A84FA5EF9E5F388D7FEA9D91140FC5","62FE722B2BF323B318BA1D9C24FDEC51","CC53E7AEF38AC57499AEB0B1ED3909C9","4D12C03CE1F90E329F28CA194ABAB826","DCFC26743D5E2897112626F67612067D")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://wordupdate.net/micro/upload","http://webinstaller.online/office/updates","https://webinstaller.online/temp/KB4783","http://release.wordupdate.net/object/encode","http://wordupdate.com/refresh/content","http://wordupdate.com/recent/update","http://the-moondelight.96.lt/followup/update/KB756324","http://recent.wordupdate.com/cloud/sync/upgrade","http://185.203.*.42/uphta/z.vbs","http://classcentral-*.ddns.net/TNC/Class_Central.zip","http://dump*ngs.ml/Jdsuifyiusdyf.txt","http://dump*ngs.ml/Kewuiuryjd.txt","http://dump*ngs.ml/ZeroToleranceMonth.jpg","http://fil*oni.digital/HprodXprnvlm1.php","http://fil*oni.digital/VueWsxpogcjwq1.php","http://fu*tifu.live/ksjdSudh/hsfuYNm.txt","http://msd*igns.site/google/goopdate.dll","http://office*oud.store/update.dotm","http://pirna*m.xyz/Bdsfunklo.php","http://pirna*m.xyz/Vksufnduw.php","http://pirna*m.xyz/YblSNyirp/","http://release.word*date.net/object/encode","http://thak*aiya.xyz/Bdsfunklo.php","http://thak*aiya.xyz/SuMkdsfui.php","http://thak*aiya.xyz/Vksufnduw.php","http://webi*taller.online/V6.exe","http://webi*taller.online/office/updates","http://word*date.net/micro/upload","http://word*date.net/wordpress","https://www.fbr-no*ce.com/iris/file.php?file=FBR","https://t7g*c.app.link/Kit8V9GsIqb","https://t7g*c.app.link/RKQX1PtSJqb","https://t7g*c.app.link/qweqweqw")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "pmogov.info" OR destinationhostname CONTAINS "pmogov.online" OR destinationhostname CONTAINS "ndu-edu.digital" OR destinationhostname CONTAINS "psca-gop-pk.digital" OR destinationhostname CONTAINS "nadra.digital" OR destinationhostname CONTAINS "mofa-pk-server.live" OR destinationhostname CONTAINS "fbr-notice.com" OR destinationhostname CONTAINS "fbr-tax.info" OR destinationhostname CONTAINS "notice-fbr.tax" OR destinationhostname CONTAINS "fbr-mail.online" OR destinationhostname CONTAINS "csd-pk.online" OR destinationhostname CONTAINS "classcentral-*.ddns.net" OR destinationhostname CONTAINS "dump*ngs.ml" OR destinationhostname CONTAINS "fil*oni.digital" OR destinationhostname CONTAINS "fu*tifu.live" OR destinationhostname CONTAINS "msd*igns.site" OR destinationhostname CONTAINS "office*oud.store" OR destinationhostname CONTAINS "pirna*m.xyz" OR destinationhostname CONTAINS "release.word*date.net" OR destinationhostname CONTAINS "thak*aiya.xyz" OR destinationhostname CONTAINS "webi*taller.online" OR destinationhostname CONTAINS "word*date.net" OR destinationhostname CONTAINS "fbr-no*ce.com" OR destinationhostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "pmogov.info" OR sourcentdomain CONTAINS "pmogov.online" OR sourcentdomain CONTAINS "ndu-edu.digital" OR sourcentdomain CONTAINS "psca-gop-pk.digital" OR sourcentdomain CONTAINS "nadra.digital" OR sourcentdomain CONTAINS "mofa-pk-server.live" OR sourcentdomain CONTAINS "fbr-notice.com" OR sourcentdomain CONTAINS "fbr-tax.info" OR sourcentdomain CONTAINS "notice-fbr.tax" OR sourcentdomain CONTAINS "fbr-mail.online" OR sourcentdomain CONTAINS "csd-pk.online" OR sourcentdomain CONTAINS "classcentral-*.ddns.net" OR sourcentdomain CONTAINS "dump*ngs.ml" OR sourcentdomain CONTAINS "fil*oni.digital" OR sourcentdomain CONTAINS "fu*tifu.live" OR sourcentdomain CONTAINS "msd*igns.site" OR sourcentdomain CONTAINS "office*oud.store" OR sourcentdomain CONTAINS "pirna*m.xyz" OR sourcentdomain CONTAINS "release.word*date.net" OR sourcentdomain CONTAINS "thak*aiya.xyz" OR sourcentdomain CONTAINS "webi*taller.online" OR sourcentdomain CONTAINS "word*date.net" OR sourcentdomain CONTAINS "fbr-no*ce.com" OR sourcentdomain CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "pmogov.info" OR sourcehostname CONTAINS "pmogov.online" OR sourcehostname CONTAINS "ndu-edu.digital" OR sourcehostname CONTAINS "psca-gop-pk.digital" OR sourcehostname CONTAINS "nadra.digital" OR sourcehostname CONTAINS "mofa-pk-server.live" OR sourcehostname CONTAINS "fbr-notice.com" OR sourcehostname CONTAINS "fbr-tax.info" OR sourcehostname CONTAINS "notice-fbr.tax" OR sourcehostname CONTAINS "fbr-mail.online" OR sourcehostname CONTAINS "csd-pk.online" OR sourcehostname CONTAINS "classcentral-*.ddns.net" OR sourcehostname CONTAINS "dump*ngs.ml" OR sourcehostname CONTAINS "fil*oni.digital" OR sourcehostname CONTAINS "fu*tifu.live" OR sourcehostname CONTAINS "msd*igns.site" OR sourcehostname CONTAINS "office*oud.store" OR sourcehostname CONTAINS "pirna*m.xyz" OR sourcehostname CONTAINS "release.word*date.net" OR sourcehostname CONTAINS "thak*aiya.xyz" OR sourcehostname CONTAINS "webi*taller.online" OR sourcehostname CONTAINS "word*date.net" OR sourcehostname CONTAINS "fbr-no*ce.com" OR sourcehostname CONTAINS "t7g*c.app.link")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "pmogov.info" OR destinationntdomain CONTAINS "pmogov.online" OR destinationntdomain CONTAINS "ndu-edu.digital" OR destinationntdomain CONTAINS "psca-gop-pk.digital" OR destinationntdomain CONTAINS "nadra.digital" OR destinationntdomain CONTAINS "mofa-pk-server.live" OR destinationntdomain CONTAINS "fbr-notice.com" OR destinationntdomain CONTAINS "fbr-tax.info" OR destinationntdomain CONTAINS "notice-fbr.tax" OR destinationntdomain CONTAINS "fbr-mail.online" OR destinationntdomain CONTAINS "csd-pk.online" OR destinationntdomain CONTAINS "classcentral-*.ddns.net" OR destinationntdomain CONTAINS "dump*ngs.ml" OR destinationntdomain CONTAINS "fil*oni.digital" OR destinationntdomain CONTAINS "fu*tifu.live" OR destinationntdomain CONTAINS "msd*igns.site" OR destinationntdomain CONTAINS "office*oud.store" OR destinationntdomain CONTAINS "pirna*m.xyz" OR destinationntdomain CONTAINS "release.word*date.net" OR destinationntdomain CONTAINS "thak*aiya.xyz" OR destinationntdomain CONTAINS "webi*taller.online" OR destinationntdomain CONTAINS "word*date.net" OR destinationntdomain CONTAINS "fbr-no*ce.com" OR destinationntdomain CONTAINS "t7g*c.app.link")
