index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationhostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationhostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationhostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationhostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationhostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationhostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationhostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationhostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationhostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationhostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationhostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationhostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationhostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationhostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationhostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationhostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationhostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationhostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationhostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationhostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationhostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationhostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationhostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationhostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationhostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationhostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationhostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationhostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationhostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationhostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationhostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationhostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationhostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationhostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationhostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationhostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationhostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationhostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationhostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationhostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationhostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationhostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationhostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationhostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationhostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationhostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationhostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcentdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcentdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcentdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcentdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcentdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcentdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcentdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcentdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcentdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcentdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcentdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcentdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcentdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcentdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcentdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcentdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcentdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcentdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcentdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcentdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcentdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcentdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcentdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcentdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcentdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcentdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcentdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcentdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcentdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcentdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcentdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcentdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcentdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcentdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcentdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcentdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcentdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcentdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcentdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcentdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcentdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcentdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcentdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcentdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcentdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcentdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcentdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR sourcehostname CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR sourcehostname CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR sourcehostname CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR sourcehostname CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR sourcehostname CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR sourcehostname CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR sourcehostname CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR sourcehostname CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR sourcehostname CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR sourcehostname CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR sourcehostname CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR sourcehostname CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR sourcehostname CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR sourcehostname CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR sourcehostname CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR sourcehostname CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR sourcehostname CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR sourcehostname CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR sourcehostname CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR sourcehostname CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR sourcehostname CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR sourcehostname CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR sourcehostname CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR sourcehostname CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR sourcehostname CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR sourcehostname CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR sourcehostname CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR sourcehostname CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR sourcehostname CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR sourcehostname CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR sourcehostname CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR sourcehostname CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR sourcehostname CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR sourcehostname CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR sourcehostname CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR sourcehostname CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR sourcehostname CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR sourcehostname CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR sourcehostname CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR sourcehostname CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR sourcehostname CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR sourcehostname CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR sourcehostname CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR sourcehostname CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR sourcehostname CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR sourcehostname CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR sourcehostname CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR destinationntdomain CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR destinationntdomain CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR destinationntdomain CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR destinationntdomain CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR destinationntdomain CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR destinationntdomain CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR destinationntdomain CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR destinationntdomain CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR destinationntdomain CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR destinationntdomain CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR destinationntdomain CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR destinationntdomain CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR destinationntdomain CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR destinationntdomain CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR destinationntdomain CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR destinationntdomain CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR destinationntdomain CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR destinationntdomain CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR destinationntdomain CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR destinationntdomain CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR destinationntdomain CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR destinationntdomain CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR destinationntdomain CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR destinationntdomain CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR destinationntdomain CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR destinationntdomain CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR destinationntdomain CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR destinationntdomain CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR destinationntdomain CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR destinationntdomain CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR destinationntdomain CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR destinationntdomain CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR destinationntdomain CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR destinationntdomain CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR destinationntdomain CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR destinationntdomain CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR destinationntdomain CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR destinationntdomain CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR destinationntdomain CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR destinationntdomain CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR destinationntdomain CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR destinationntdomain CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR destinationntdomain CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR destinationntdomain CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR destinationntdomain CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR destinationntdomain CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR destinationntdomain CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion" OR requesturl CONTAINS "lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion" OR requesturl CONTAINS "lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion" OR requesturl CONTAINS "lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion" OR requesturl CONTAINS "lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion" OR requesturl CONTAINS "lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion" OR requesturl CONTAINS "lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion" OR requesturl CONTAINS "lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion" OR requesturl CONTAINS "lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion" OR requesturl CONTAINS "lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion" OR requesturl CONTAINS "lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion" OR requesturl CONTAINS "lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion" OR requesturl CONTAINS "lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion" OR requesturl CONTAINS "lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion" OR requesturl CONTAINS "lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion" OR requesturl CONTAINS "lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion" OR requesturl CONTAINS "lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion" OR requesturl CONTAINS "lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion" OR requesturl CONTAINS "lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion" OR requesturl CONTAINS "lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion" OR requesturl CONTAINS "llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion" OR requesturl CONTAINS "lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion" OR requesturl CONTAINS "llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion" OR requesturl CONTAINS "llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion" OR requesturl CONTAINS "ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion" OR requesturl CONTAINS "lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion" OR requesturl CONTAINS "llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion" OR requesturl CONTAINS "llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion" OR requesturl CONTAINS "ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion" OR requesturl CONTAINS "f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion" OR requesturl CONTAINS "lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion" OR requesturl CONTAINS "lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion" OR requesturl CONTAINS "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion" OR requesturl CONTAINS "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion" OR requesturl CONTAINS "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion" OR requesturl CONTAINS "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion" OR requesturl CONTAINS "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion" OR requesturl CONTAINS "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion" OR requesturl CONTAINS "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion" OR requesturl CONTAINS "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion" OR requesturl CONTAINS "lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion" OR requesturl CONTAINS "lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion" OR requesturl CONTAINS "lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion" OR requesturl CONTAINS "lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion" OR requesturl CONTAINS "lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion" OR requesturl CONTAINS "lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion" OR requesturl CONTAINS "lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion" OR requesturl CONTAINS "lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationhostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationhostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationhostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationhostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcentdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcentdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcentdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcentdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR sourcehostname CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR sourcehostname CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR sourcehostname CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR sourcehostname CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR destinationntdomain CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR destinationntdomain CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR destinationntdomain CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR destinationntdomain CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion" OR requesturl CONTAINS "lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion" OR requesturl CONTAINS "lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion" OR requesturl CONTAINS "lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion" OR requesturl CONTAINS "lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("84.201.211.40","199.232.210.172")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Content Management System" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Microsoft Windows" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Microsoft Windows" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Microsoft Windows" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Services / Applications" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Services / Applications" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / VPN" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / VPN" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / VPN" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Content Management System" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Network Access Control / NAC" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Network Access Control / NAC" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Virtualization / Containers" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Virtualization / Containers" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Privileged User" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Privileged User" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Privileged User" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Identity Management" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Identity Management" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Access / Identity Management" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Identity Access Management" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Identity Access Management" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Identity Access Management" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / WiFi" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / WiFi" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("8ff61e4156c10b085e0c2233f24e8501","1319da1523ec2a67bda016c15334c195","0eff1f3ca94f1c8aeb4b720d6dd54fc3","e3a12d15768160d5c534cd99df9199e9","17a7cd1ead2d35ed5d69c71d4fd7386d","9bb6340600f80baa4eb6777266f5f0df","42cbb4743ea016868d7a049a6c9fb3fc","8015d634e9e5fd003885700bca4723d8","a8e97fe5a7115e42759d67f7e4d88b0d","d0457a54a4905ed5d2bb8a2b7ef7be0f","7e525ef64a4e27fbb325d7cb4653f0a1","d96d2bcf13d55740f3bb64d45d2db94d","2b84852065e28974e4081826ff09ddc1","e0411fcbbff0e20922d224c3ac8c811e")
