index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("185.176.43.106","185.176.43.90","185.176.43.98","185.176.43.96","185.176.43.94","185.176.43.80","185.176.43.84","185.176.43.82")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "activate-suport-up-date-142i.eu5.net" OR destinationhostname CONTAINS "adm-up-da-te-x2020x89354.eu5.net" OR destinationhostname CONTAINS "i197--activate-up-date.eu5.net" OR destinationhostname CONTAINS "xt543-suport-up-date.eu5.net" OR destinationhostname CONTAINS "8xe3615-12-2019-up-date.eu3.org" OR destinationhostname CONTAINS "i131dere-up-date.eu3.biz" OR destinationhostname CONTAINS "jan-6543-up-date.eu3.biz" OR destinationhostname CONTAINS "x437-suport-up-dates.eu5.net" OR destinationhostname CONTAINS "e541-suport-up-date.eu5.net" OR destinationhostname CONTAINS "x914-suport-up-date.eu5.net" OR destinationhostname CONTAINS "4877-activate-up-date.eu5.net" OR destinationhostname CONTAINS "active-up-date-xk89si.eu5.net" OR destinationhostname CONTAINS "activate-suport-up-date-i754.eu3.biz" OR destinationhostname CONTAINS "activate-suport-up-date-321i.eu3.biz" OR destinationhostname CONTAINS "adms-suport-up-datex8323.eu3.biz" OR destinationhostname CONTAINS "05-2019-up-date.eu5.net" OR destinationhostname CONTAINS "x07-2019-up-date.eu5.net" OR destinationhostname CONTAINS "08-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "07-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "adms-up-date-2020.eu5.net" OR destinationhostname CONTAINS "adm-up-date-2020x68293.eu5.net" OR destinationhostname CONTAINS "08-2019-up-da-tex.eu5.net" OR destinationhostname CONTAINS "06-2019-up-date1.eu5.net" OR destinationhostname CONTAINS "04-2019-upd.eu5.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "activate-suport-up-date-142i.eu5.net" OR destinationhostname CONTAINS "adm-up-da-te-x2020x89354.eu5.net" OR destinationhostname CONTAINS "i197--activate-up-date.eu5.net" OR destinationhostname CONTAINS "xt543-suport-up-date.eu5.net" OR destinationhostname CONTAINS "8xe3615-12-2019-up-date.eu3.org" OR destinationhostname CONTAINS "i131dere-up-date.eu3.biz" OR destinationhostname CONTAINS "jan-6543-up-date.eu3.biz" OR destinationhostname CONTAINS "x437-suport-up-dates.eu5.net" OR destinationhostname CONTAINS "e541-suport-up-date.eu5.net" OR destinationhostname CONTAINS "x914-suport-up-date.eu5.net" OR destinationhostname CONTAINS "4877-activate-up-date.eu5.net" OR destinationhostname CONTAINS "active-up-date-xk89si.eu5.net" OR destinationhostname CONTAINS "activate-suport-up-date-i754.eu3.biz" OR destinationhostname CONTAINS "activate-suport-up-date-321i.eu3.biz" OR destinationhostname CONTAINS "adms-suport-up-datex8323.eu3.biz" OR destinationhostname CONTAINS "05-2019-up-date.eu5.net" OR destinationhostname CONTAINS "x07-2019-up-date.eu5.net" OR destinationhostname CONTAINS "08-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "07-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "adms-up-date-2020.eu5.net" OR destinationhostname CONTAINS "adm-up-date-2020x68293.eu5.net" OR destinationhostname CONTAINS "08-2019-up-da-tex.eu5.net" OR destinationhostname CONTAINS "06-2019-up-date1.eu5.net" OR destinationhostname CONTAINS "04-2019-upd.eu5.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "activate-suport-up-date-142i.eu5.net" OR destinationhostname CONTAINS "adm-up-da-te-x2020x89354.eu5.net" OR destinationhostname CONTAINS "i197--activate-up-date.eu5.net" OR destinationhostname CONTAINS "xt543-suport-up-date.eu5.net" OR destinationhostname CONTAINS "8xe3615-12-2019-up-date.eu3.org" OR destinationhostname CONTAINS "i131dere-up-date.eu3.biz" OR destinationhostname CONTAINS "jan-6543-up-date.eu3.biz" OR destinationhostname CONTAINS "x437-suport-up-dates.eu5.net" OR destinationhostname CONTAINS "e541-suport-up-date.eu5.net" OR destinationhostname CONTAINS "x914-suport-up-date.eu5.net" OR destinationhostname CONTAINS "4877-activate-up-date.eu5.net" OR destinationhostname CONTAINS "active-up-date-xk89si.eu5.net" OR destinationhostname CONTAINS "activate-suport-up-date-i754.eu3.biz" OR destinationhostname CONTAINS "activate-suport-up-date-321i.eu3.biz" OR destinationhostname CONTAINS "adms-suport-up-datex8323.eu3.biz" OR destinationhostname CONTAINS "05-2019-up-date.eu5.net" OR destinationhostname CONTAINS "x07-2019-up-date.eu5.net" OR destinationhostname CONTAINS "08-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "07-2019-up-datex.eu5.net" OR destinationhostname CONTAINS "adms-up-date-2020.eu5.net" OR destinationhostname CONTAINS "adm-up-date-2020x68293.eu5.net" OR destinationhostname CONTAINS "08-2019-up-da-tex.eu5.net" OR destinationhostname CONTAINS "06-2019-up-date1.eu5.net" OR destinationhostname CONTAINS "04-2019-upd.eu5.net")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://saleswarriorinc.com/aba/login/index.php","http://armaghanteb.com/bul/login/index.php","http://quadteximagery.com/veri/login/index.php","https://primage.com.br/aa/update/index.php","https://alphabitconsulting.com/veri/login/index.php","https://centralinsumos.com.bo/update/index.php","https://pwametalurgica.com.br/bb/update/index.php","https://cercoselectricos.cl/aa/update/index.php","https://flammaautomoveis.com.br/bul/update/index.php","http://englishlessons-houston.com/les/welcome/?user=","http://saojoaodaurtigars.com.br/malaysia/login/?user=")
