rg_functionality="Next generation firewall" AND  requestclientapplication CONTAINS "jndi" AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" OR requestclientapplication CONTAINS "%7Bjndi") 
rg_functionality="Next generation firewall" AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" OR requestclientapplication CONTAINS "${env" OR requestclientapplication CONTAINS "%7Bjndi" OR requestclientapplication CONTAINS "}${" OR requestclientapplication CONTAINS "${ctx:" OR requestclientapplication CONTAINS "${sd:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS ":-j}$" )
Index= activity and rg_functionality = "Next generation firewall" and (requestclientapplication contains "%6a" or requestclientapplication contains "%4a" or requestclientapplication contains "%6e" or requestclientapplication contains "%1e" or requestclientapplication contains "%14" or requestclientapplication contains "%64" or requestclientapplication contains "%19" or requestclientapplication contains "%69" or requestclientapplication contains "%3a" OR requestclientapplication CONTAINS "%7Bjndi") 
rg_functionality="Web application firewall" AND requestclientapplication CONTAINS "jndi"  AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" OR requestclientapplication CONTAINS "%7Bjndi" ) 
rg_functionality="Web application firewall" AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::"  OR requestclientapplication CONTAINS "%7Bjndi" OR requestclientapplication CONTAINS "}${" OR requestclientapplication CONTAINS "${ctx:" OR requestclientapplication CONTAINS "${sd:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS ":-j}$") 
Index= activity and rg_functionality = "web application firewall" and (requestclientapplication contains "%6a" or requestclientapplication contains "%4a" or requestclientapplication contains "%6e" or requestclientapplication contains "%1e" or requestclientapplication contains "%14" or requestclientapplication contains "%64" or requestclientapplication contains "%19" or requestclientapplication contains "%69" or requestclientapplication contains "%3a" OR requestclientapplication CONTAINS "%7Bjndi")
rg_functionality="web server" AND requestclientapplication CONTAINS "jndi" AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" OR requestclientapplication CONTAINS "%7Bjndi" ) 
rg_functionality="web server"   AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" OR requestclientapplication CONTAINS "%7Bjndi" OR requestclientapplication CONTAINS "}${“ OR requestclientapplication CONTAINS "${ctx:" OR requestclientapplication CONTAINS "${sd:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS ":-j}$") 
Index= activity and rg_functionality = "web server" and (requestclientapplication contains "%6a" or requestclientapplication contains "%4a" or requestclientapplication contains "%6e" or requestclientapplication contains "%1e" or requestclientapplication contains "%14" or requestclientapplication contains "%64" or requestclientapplication contains "%19" or requestclientapplication contains "%69" or requestclientapplication contains "%3a" OR requestclientapplication CONTAINS "%7Bjndi")
rg_functionality="Web proxy" AND requestclientapplication CONTAINS "jndi" AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" OR requestclientapplicationSecuronix Log4J CVE Update 20211217 CONTAINS "%7Bjndi" ) 
rg_functionality="Web proxy"   AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" OR requestclientapplication CONTAINS "%7Bjndi" OR requestclientapplication CONTAINS "}${" OR requestclientapplication CONTAINS "${ctx:" OR requestclientapplication CONTAINS "${sd:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS "${map:" OR requestclientapplication CONTAINS ":-j}$") 
Index= activity and rg_functionality = "Web proxy" and (requestclientapplication contains "%6a" or requestclientapplication contains "%4a" or requestclientapplication contains "%6e" or requestclientapplication contains "%1e" or requestclientapplication contains "%14" or requestclientapplication contains "%64" or requestclientapplication contains "%19" or requestclientapplication contains "%69" or requestclientapplication contains "%3a" OR requestclientapplication CONTAINS "%7Bjndi")
rg_functionality="Next generation firewall" AND requesturl CONTAINS "jndi"  AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" ) 
rg_functionality="Next generation firewall"  AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::"  OR requesturl CONTAINS "%7Bjndi" OR requesturl CONTAINS "}${" OR requesturl CONTAINS "${ctx:" OR requesturl CONTAINS "${sd:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS ":-j}$") 
rg_functionality="Web proxy" AND requesturl CONTAINS "jndi" AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" ) 
rg_functionality="Web proxy" AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::"  OR requesturl CONTAINS "%7Bjndi" OR requesturl CONTAINS "}${" OR requesturl CONTAINS "${ctx:" OR requesturl CONTAINS "${sd:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS ":-j}$")
rg_functionality="web server" AND requesturl CONTAINS "jndi"  AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper"  OR requesturl CONTAINS "%7Bjndi") ) 
rg_functionality="Web server" AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::"  OR requesturl CONTAINS "%7Bjndi"  OR requesturl CONTAINS "}${" OR requesturl CONTAINS "${ctx:" OR requesturl CONTAINS "${sd:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS ":-j}$")
rg_functionality="Web application firewall" AND requesturl CONTAINS "jndi" AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" )
rg_functionality="Web application firewall" " AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::"  OR requesturl CONTAINS "%7Bjndi" OR requesturl CONTAINS "}${" OR requesturl CONTAINS "${ctx:" OR requesturl CONTAINS "${sd:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS "${map:" OR requesturl CONTAINS ":-j}$") 
rg_functionality="web server" AND requestcontext CONTAINS "jndi"  AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper"  OR requestcontext CONTAINS "%7Bjndi" )
rg_functionality="web server" AND ipaddress NOT NULL  AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" OR requestcontext CONTAINS "%7Bjndi" OR requestcontext CONTAINS 
"}${" OR requestcontext CONTAINS "${ctx:" OR requestcontext CONTAINS "${sd:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS ":-j}$")
rg_functionality="Web proxy" AND requestcontext CONTAINS "jndi"  AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper" OR requestcontext CONTAINS "%7Bjndi" )
rg_functionality="Web proxy"  AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" OR requestcontext CONTAINS "%7Bjndi" OR requestcontext CONTAINS "}${" OR requestcontext CONTAINS "${ctx:" OR requestcontext CONTAINS "${sd:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS ":-j}$") 
rg_functionality="Web application firewall" AND requestcontext CONTAINS "jndi"  AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper" OR requestcontext CONTAINS "%7Bjndi" ) 
rg_functionality="Web application firewall" AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" OR requestcontext CONTAINS "%7Bjndi" OR requestcontext CONTAINS "}${" OR requestcontext CONTAINS "${ctx:" OR requestcontext CONTAINS "${sd:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS "${map:" OR requestcontext CONTAINS ":-j}$")
rg_functionality = "Next Generation Firewall" AND applicationprotocol = "ldap" AND (destinationport != "389" OR destinationport != "636")
rg_functionality = "Endpoint Management Systems" AND baseeventid = "22" AND (destinationhostname ENDS WITH "hashvault.pro" OR destinationhostname ENDS WITH "nanopool.org" OR destinationhostname ENDS WITH "minergate.com" OR destinationhostname ENDS WITH "minexmr.com" OR destinationhostname ENDS WITH "supportxmr.com")
rg_functionality = "Web Proxy" AND (destinationhostname ENDS WITH "minergate.com" OR destinationhostname ENDS WITH "nanopool.org" OR destinationhostname ENDS WITH "minergate.com" OR destinationhostname ENDS WITH "minexmr.com" OR destinationhostname ENDS WITH "supportxmr.com")
rg_functionality = "Unix / Linux / AIX" AND baseeventid = "1" AND (resourcecustomfield1 CONTAINS "xmr" OR resourcecustomfield1 CONTAINS "cryptonight" OR resourcecustomfield1 CONTAINS "hashrate" OR resourcecustomfield1 CONTAINS "dockerminer" OR resourcecustomfield1 CONTAINS "oceanhole" OR resourcecustomfield1 CONTAINS "minergate" OR resourcecustomfield1 CONTAINS "stratum+tcp://" OR resourcecustomfield1 CONTAINS " --nicehash")
rg_functionality = "Microsoft Windows" AND baseeventid = "4781" AND ^str_devicecustomstring4_oldtargetusername ENDS WITH "$" AND ^str_devicecustomstring4_newtargetusername NOT ENDS WITH "$"
rg_functionality = "Endpoint Management Systems" AND (deviceaction = "Process Create" OR deviceaction = "Process Create (rule: ProcessCreate)" OR deviceaction = "ProcessRollup2" OR deviceaction = "SyntheticProcessRollUp2" OR deviceaction = "WmiCreateProcess" OR deviceaction = "Trace Executed Process" OR deviceaction = "Process" OR deviceaction = "Childproc" OR deviceaction = "Procstart" OR deviceaction = "Process Activity: Launched") AND destinationprocessname ENDS WITH "red.exe" AND resourcecustomfield1 CONTAINS " add " AND resourcecustomfield1 CONTAINS "javaw.exe" AND resourcecustomfield1 CONTAINS " -jar " AND resourcecustomfield1 CONTAINS ".class"
rg_functionality = "Endpoint Management Systems" AND (baseeventid = "12" OR baseeventid = "13" OR baseeventid = "14") AND AND devicecustomstring2 ENDS WITH "\Software\Microsoft\Windows\CurrentVersion\Run" AND transactionstring5 = "SetValue" AND customstring2 CONTAINS "javaw.exe" AND customstring2 CONTAINS " -jar " AND customstring2 CONTAINS ".class"
rg_functionality = "Next Generation Firewall" AND (requesturl CONTAINS "doh.defaultroutes.de" OR requesturl CONTAINS "dns.hostux.net" OR requesturl CONTAINS "dns.dns-over-https.com" OR requesturl CONTAINS "uncensored.lux1.dns.nixnet.xyz" OR requesturl CONTAINS "dns.rubyfish.cn" OR requesturl CONTAINS "dns.twnic.tw" OR requesturl CONTAINS "doh.centraleu.pi-dns.com" OR requesturl CONTAINS "doh.dns.sb" OR requesturl CONTAINS "doh-fi.blahdns.com" OR requesturl CONTAINS "fi.doh.dns.snopyta.org" OR requesturl CONTAINS "dns.flatuslifir.is" OR requesturl CONTAINS "doh.li" OR requesturl CONTAINS "dns.digitale-gesellschaft.ch")
rg_functionality = "Next Generation Firewall" AND requestclientapplication CONTAINS "Java" AND requesturl ENDS WITH ".class"
rg_functionality = "Next Generation Firewall" AND requesturl ENDS WITH ".class" | rare requestclientapplication

index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("18.27.197.252","23.129.64.131","23.129.64.141","23.129.64.146","23.129.64.148","45.12.134.108","45.155.205.233","46.166.139.111","46.182.21.248","51.15.43.205","51.255.106.85","54.173.99.121","62.102.148.69","72.223.168.73","81.17.18.60","104.244.72.115","104.244.74.57","104.244.74.211","104.244.76.170","107.189.1.160","107.189.1.178","107.189.12.135","107.189.14.98","122.161.50.23","171.25.193.20","171.25.193.25","171.25.193.77","171.25.193.78","178.62.79.49","181.214.39.2","185.38.175.132","185.83.214.69","185.100.87.41","185.100.87.202","185.107.47.171","185.129.61.1","185.220.100.240","185.220.100.242","185.220.100.243","185.220.100.244","185.220.100.245","185.220.100.246","185.220.100.247","185.220.100.248","185.220.100.249","185.220.100.252","185.220.100.253","185.220.100.254","185.220.100.255","185.220.101.33","185.220.101.34","185.220.101.35","185.220.101.36","185.220.101.42","185.220.101.43","185.220.101.45","185.220.101.46","185.220.101.49","185.220.101.54","185.220.101.55","185.220.101.56","185.220.101.61","185.220.101.129","185.220.101.138","185.220.101.139","185.220.101.141","185.220.101.142","185.220.101.143","185.220.101.145","185.220.101.147","185.220.101.148","185.220.101.149","185.220.101.153","185.220.101.156","185.220.101.157","185.220.101.158","185.220.101.161","185.220.101.163","185.220.101.168","185.220.101.169","185.220.101.172","185.220.101.175","185.220.101.177","185.220.101.179","185.220.101.180","185.220.101.181","185.220.101.182","185.220.101.185","185.220.101.189","185.220.101.191","185.220.102.8","185.220.102.242","193.31.24.154","193.189.100.203","193.218.118.231","194.48.199.78","195.176.3.24","195.254.135.76","198.98.51.189")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("199.195.250.77","204.8.156.142","205.185.117.149","209.127.17.242","209.141.41.103","62.76.41.46","80.71.158.12","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("80.71.158.12","62.76.41.46","212.193.57.225","109.237.96.124")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bingsearchlib.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bingsearchlib.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bingsearchlib.com")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("192.46.237.113","159.223.56.6","61.19.25.207","161.35.156.151","185.220.101.53","192.42.116.18","112.74.52.90","187.86.165.46","194.48.199.78","178.176.203.190","23.129.64.148","138.197.72.76","45.155.204.20","205.185.125.147","163.172.60.213","185.220.101.158","185.220.100.251","151.80.148.159","185.220.101.45","1.116.59.211","185.220.101.146","20.205.104.227","103.214.5.13","159.223.75.133","120.24.23.84","167.71.13.196","185.220.101.172","189.188.33.125","185.220.101.133","104.192.3.118","185.220.100.253","147.182.216.21","170.210.45.163","141.239.152.254","199.195.251.182","185.167.163.118","68.183.198.36","45.155.205.233","159.89.94.219","185.220.100.252","195.201.175.217","159.223.42.182","164.90.199.221","31.42.184.34","60.31.180.149","217.79.189.13","185.100.87.174","51.195.42.226","162.255.202.246","209.141.46.47","195.251.41.139","139.59.103.254","194.163.163.20","176.58.100.98","167.99.162.76","191.232.38.25","68.183.36.244","89.249.63.3","147.182.150.18","185.220.101.21","64.113.32.29","185.220.101.152","209.97.133.112","198.98.51.189","159.65.155.208","185.220.101.54","107.189.29.105","185.220.101.173","185.220.101.128","103.103.0.142","150.158.189.96","195.54.160.149","161.35.119.60","107.189.29.107","185.100.87.72","54.146.233.218","138.197.9.239","167.99.36.245","139.177.177.104","178.176.202.121","5.157.38.50","217.160.174.204","167.172.44.255","45.137.21.9","45.61.187.34","45.146.164.160","20.71.156.146","185.220.101.143","175.6.210.66","138.197.106.234","51.15.43.205","45.129.56.200","185.17.121.251","197.246.171.83","128.199.222.221")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("192.46.237.113","159.223.56.6","61.19.25.207","161.35.156.151","185.220.101.53","192.42.116.18","112.74.52.90","187.86.165.46","194.48.199.78","178.176.203.190","23.129.64.148","138.197.72.76","45.155.204.20","205.185.125.147","163.172.60.213","185.220.101.158","185.220.100.251","151.80.148.159","185.220.101.45","1.116.59.211","185.220.101.146","20.205.104.227","103.214.5.13","159.223.75.133","120.24.23.84","167.71.13.196","185.220.101.172","189.188.33.125","185.220.101.133","104.192.3.118","185.220.100.253","147.182.216.21","170.210.45.163","141.239.152.254","199.195.251.182","185.167.163.118","68.183.198.36","45.155.205.233","159.89.94.219","185.220.100.252","195.201.175.217","159.223.42.182","164.90.199.221","31.42.184.34","60.31.180.149","217.79.189.13","185.100.87.174","51.195.42.226","162.255.202.246","209.141.46.47","195.251.41.139","139.59.103.254","194.163.163.20","176.58.100.98","167.99.162.76","191.232.38.25","68.183.36.244","89.249.63.3","147.182.150.18","185.220.101.21","64.113.32.29","185.220.101.152","209.97.133.112","198.98.51.189","159.65.155.208","185.220.101.54","107.189.29.105","185.220.101.173","185.220.101.128","103.103.0.142","150.158.189.96","195.54.160.149","161.35.119.60","107.189.29.107","185.100.87.72","54.146.233.218","138.197.9.239","167.99.36.245","139.177.177.104","178.176.202.121","5.157.38.50","217.160.174.204","167.172.44.255","45.137.21.9","45.61.187.34","45.146.164.160","20.71.156.146","185.220.101.143","175.6.210.66","138.197.106.234","51.15.43.205","45.129.56.200","185.17.121.251","197.246.171.83","128.199.222.221")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("192.46.237.113","159.223.56.6","61.19.25.207","161.35.156.151","185.220.101.53","192.42.116.18","112.74.52.90","187.86.165.46","194.48.199.78","178.176.203.190","23.129.64.148","138.197.72.76","45.155.204.20","205.185.125.147","163.172.60.213","185.220.101.158","185.220.100.251","151.80.148.159","185.220.101.45","1.116.59.211","185.220.101.146","20.205.104.227","103.214.5.13","159.223.75.133","120.24.23.84","167.71.13.196","185.220.101.172","189.188.33.125","185.220.101.133","104.192.3.118","185.220.100.253","147.182.216.21","170.210.45.163","141.239.152.254","199.195.251.182","185.167.163.118","68.183.198.36","45.155.205.233","159.89.94.219","185.220.100.252","195.201.175.217","159.223.42.182","164.90.199.221","31.42.184.34","60.31.180.149","217.79.189.13","185.100.87.174","51.195.42.226","162.255.202.246","209.141.46.47","195.251.41.139","139.59.103.254","194.163.163.20","176.58.100.98","167.99.162.76","191.232.38.25","68.183.36.244","89.249.63.3","147.182.150.18","185.220.101.21","64.113.32.29","185.220.101.152","209.97.133.112","198.98.51.189","159.65.155.208","185.220.101.54","107.189.29.105","185.220.101.173","185.220.101.128","103.103.0.142","150.158.189.96","195.54.160.149","161.35.119.60","107.189.29.107","185.100.87.72","54.146.233.218","138.197.9.239","167.99.36.245","139.177.177.104","178.176.202.121","5.157.38.50","217.160.174.204","167.172.44.255","45.137.21.9","45.61.187.34","45.146.164.160","20.71.156.146","185.220.101.143","175.6.210.66","138.197.106.234","51.15.43.205","45.129.56.200","185.17.121.251","197.246.171.83","128.199.222.221")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("192.46.237.113","159.223.56.6","61.19.25.207","161.35.156.151","185.220.101.53","192.42.116.18","112.74.52.90","187.86.165.46","194.48.199.78","178.176.203.190","23.129.64.148","138.197.72.76","45.155.204.20","205.185.125.147","163.172.60.213","185.220.101.158","185.220.100.251","151.80.148.159","185.220.101.45","1.116.59.211","185.220.101.146","20.205.104.227","103.214.5.13","159.223.75.133","120.24.23.84","167.71.13.196","185.220.101.172","189.188.33.125","185.220.101.133","104.192.3.118","185.220.100.253","147.182.216.21","170.210.45.163","141.239.152.254","199.195.251.182","185.167.163.118","68.183.198.36","45.155.205.233","159.89.94.219","185.220.100.252","195.201.175.217","159.223.42.182","164.90.199.221","31.42.184.34","60.31.180.149","217.79.189.13","185.100.87.174","51.195.42.226","162.255.202.246","209.141.46.47","195.251.41.139","139.59.103.254","194.163.163.20","176.58.100.98","167.99.162.76","191.232.38.25","68.183.36.244","89.249.63.3","147.182.150.18","185.220.101.21","64.113.32.29","185.220.101.152","209.97.133.112","198.98.51.189","159.65.155.208","185.220.101.54","107.189.29.105","185.220.101.173","185.220.101.128","103.103.0.142","150.158.189.96","195.54.160.149","161.35.119.60","107.189.29.107","185.100.87.72","54.146.233.218","138.197.9.239","167.99.36.245","139.177.177.104","178.176.202.121","5.157.38.50","217.160.174.204","167.172.44.255","45.137.21.9","45.61.187.34","45.146.164.160","20.71.156.146","185.220.101.143","175.6.210.66","138.197.106.234","51.15.43.205","45.129.56.200","185.17.121.251","197.246.171.83","128.199.222.221")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("192.46.237.113","159.223.56.6","61.19.25.207","161.35.156.151","185.220.101.53","192.42.116.18","112.74.52.90","187.86.165.46","194.48.199.78","178.176.203.190","23.129.64.148","138.197.72.76","45.155.204.20","205.185.125.147","163.172.60.213","185.220.101.158","185.220.100.251","151.80.148.159","185.220.101.45","1.116.59.211","185.220.101.146","20.205.104.227","103.214.5.13","159.223.75.133","120.24.23.84","167.71.13.196","185.220.101.172","189.188.33.125","185.220.101.133","104.192.3.118","185.220.100.253","147.182.216.21","170.210.45.163","141.239.152.254","199.195.251.182","185.167.163.118","68.183.198.36","45.155.205.233","159.89.94.219","185.220.100.252","195.201.175.217","159.223.42.182","164.90.199.221","31.42.184.34","60.31.180.149","217.79.189.13","185.100.87.174","51.195.42.226","162.255.202.246","209.141.46.47","195.251.41.139","139.59.103.254","194.163.163.20","176.58.100.98","167.99.162.76","191.232.38.25","68.183.36.244","89.249.63.3","147.182.150.18","185.220.101.21","64.113.32.29","185.220.101.152","209.97.133.112","198.98.51.189","159.65.155.208","185.220.101.54","107.189.29.105","185.220.101.173","185.220.101.128","103.103.0.142","150.158.189.96","195.54.160.149","161.35.119.60","107.189.29.107","185.100.87.72","54.146.233.218","138.197.9.239","167.99.36.245","139.177.177.104","178.176.202.121","5.157.38.50","217.160.174.204","167.172.44.255","45.137.21.9","45.61.187.34","45.146.164.160","20.71.156.146","185.220.101.143","175.6.210.66","138.197.106.234","51.15.43.205","45.129.56.200","185.17.121.251","197.246.171.83","128.199.222.221")

rg_functionality="Next generation firewall" AND  requestclientapplication CONTAINS "jndi" AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" ) 
rg_functionality="Next generation firewall" AND requestclientapplication CONTAINS "://"  AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" ) 
rg_functionality="Web application firewall" AND requestclientapplication CONTAINS "jndi"  AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" ) 
rg_functionality="Web application firewall" AND requestclientapplication CONTAINS "://" AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" ) 
rg_functionality="web server" AND requestclientapplication CONTAINS "jndi" AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" ) 
rg_functionality="web server" AND requestclientapplication CONTAINS "://"  AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" ) 
rg_functionality="Web proxy" AND requestclientapplication CONTAINS "jndi" ) AND ( requestclientapplication CONTAINS "dns" OR requestclientapplication CONTAINS "ldap" OR requestclientapplication CONTAINS "lower" OR requestclientapplication CONTAINS "rmi" OR requestclientapplication CONTAINS "upper" ) 
rg_functionality="Web proxy" AND requestclientapplication CONTAINS "://"  AND ( requestclientapplication CONTAINS "${upper:" OR requestclientapplication CONTAINS "${lower:" OR requestclientapplication CONTAINS "${::" ) 
rg_functionality="Next generation firewall" AND requesturl CONTAINS "jndi"  AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" ) 
rg_functionality="Next generation firewall" AND requesturl CONTAINS "://"  AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::" ) 
rg_functionality="Web proxy" AND requesturl CONTAINS "jndi" AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" ) 
rg_functionality="Web proxy" AND requesturl CONTAINS "://" AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::" ) 
rg_functionality="web server" AND requesturl CONTAINS "jndi"  AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" ) 
rg_functionality="Web serverproxy" AND requesturl CONTAINS "://" AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::" ) 
rg_functionality="Web application firewall" AND requesturl CONTAINS "jndi" ) AND ( requesturl CONTAINS "dns" OR requesturl CONTAINS "ldap" OR requesturl CONTAINS "lower" OR requesturl CONTAINS "rmi" OR requesturl CONTAINS "upper" )
rg_functionality="Web application firewall" AND requesturl CONTAINS "://" AND ( requesturl CONTAINS "${upper:" OR requesturl CONTAINS "${lower:" OR requesturl CONTAINS "${::" ) 
rg_functionality="web server" AND requestcontext CONTAINS "jndi"  AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper" )
rg_functionality="web server" AND requestcontext CONTAINS "://" AND ipaddress NOT NULL ) AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" )
rg_functionality="Web proxy" AND requestcontext CONTAINS "jndi" ) AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper" )
rg_functionality="Web proxy"  AND requestcontext CONTAINS "://" AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" ) 
rg_functionality="Web application firewall" AND requestcontext CONTAINS "jndi" ) AND ( requestcontext CONTAINS "dns" OR requestcontext CONTAINS "ldap" OR requestcontext CONTAINS "lower" OR requestcontext CONTAINS "rmi" OR requestcontext CONTAINS "upper" ) 
rg_functionality="Web application firewallWeb proxy" AND requestcontext CONTAINS "://" AND ipaddress NOT NULL ) AND ( requestcontext CONTAINS "${upper:" OR requestcontext CONTAINS "${lower:" OR requestcontext CONTAINS "${::" )
