index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("41727fc99b9d99abd7183f6eec9052f86de076c04056e224ac366762c361afda","7fbaf7420943d4aa327bb82a357cd31ca92c7c83277f73a195d45bd18365cfce","af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "idea-secure-login.com" OR destinationhostname CONTAINS "eonsabode.at" OR destinationhostname CONTAINS "biznesplanet-bnpparlba.com" OR destinationhostname CONTAINS "biznesplanet-parlbabnp.com" OR destinationhostname CONTAINS "biznesplanet-parlbas.com" OR destinationhostname CONTAINS "biznesplanet.parlbabnp.com" OR destinationhostname CONTAINS "login-biznesplanet.com" OR destinationhostname CONTAINS "bos24-logowan.com" OR destinationhostname CONTAINS "bos24-logowanie.com" OR destinationhostname CONTAINS "bos24-online.com" OR destinationhostname CONTAINS "ibos-online24.com" OR destinationhostname CONTAINS "ibos24-login.com" OR destinationhostname CONTAINS "ibos24-online.com" OR destinationhostname CONTAINS "login-bos24.com" OR destinationhostname CONTAINS "citationsherbe.at" OR destinationhostname CONTAINS "flowsrectifie.at" OR destinationhostname CONTAINS "odatingactualiz.at" OR destinationhostname CONTAINS "flash-player-update.digital" OR destinationhostname CONTAINS "flash-update.digital" OR destinationhostname CONTAINS "flashplayer-update.digital" OR destinationhostname CONTAINS "flashupdate.digital" OR destinationhostname CONTAINS "player-update.digital" OR destinationhostname CONTAINS "playerupdate.digital" OR destinationhostname CONTAINS "upgrade-flash-player.digital" OR destinationhostname CONTAINS "sso-cloud-idea.com" OR destinationhostname CONTAINS "dostawapapajohns.online" OR destinationhostname CONTAINS "onlinepapajohns.online" OR destinationhostname CONTAINS "papa-johns-dostawa.digital" OR destinationhostname CONTAINS "papa-johns-dostawa.online" OR destinationhostname CONTAINS "login.wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.biz" OR destinationhostname CONTAINS "wallet-secure.me" OR destinationhostname CONTAINS "wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.site" OR destinationhostname CONTAINS "wallet-secure.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "idea-secure-login.com" OR destinationhostname CONTAINS "eonsabode.at" OR destinationhostname CONTAINS "biznesplanet-bnpparlba.com" OR destinationhostname CONTAINS "biznesplanet-parlbabnp.com" OR destinationhostname CONTAINS "biznesplanet-parlbas.com" OR destinationhostname CONTAINS "biznesplanet.parlbabnp.com" OR destinationhostname CONTAINS "login-biznesplanet.com" OR destinationhostname CONTAINS "bos24-logowan.com" OR destinationhostname CONTAINS "bos24-logowanie.com" OR destinationhostname CONTAINS "bos24-online.com" OR destinationhostname CONTAINS "ibos-online24.com" OR destinationhostname CONTAINS "ibos24-login.com" OR destinationhostname CONTAINS "ibos24-online.com" OR destinationhostname CONTAINS "login-bos24.com" OR destinationhostname CONTAINS "citationsherbe.at" OR destinationhostname CONTAINS "flowsrectifie.at" OR destinationhostname CONTAINS "odatingactualiz.at" OR destinationhostname CONTAINS "flash-player-update.digital" OR destinationhostname CONTAINS "flash-update.digital" OR destinationhostname CONTAINS "flashplayer-update.digital" OR destinationhostname CONTAINS "flashupdate.digital" OR destinationhostname CONTAINS "player-update.digital" OR destinationhostname CONTAINS "playerupdate.digital" OR destinationhostname CONTAINS "upgrade-flash-player.digital" OR destinationhostname CONTAINS "sso-cloud-idea.com" OR destinationhostname CONTAINS "dostawapapajohns.online" OR destinationhostname CONTAINS "onlinepapajohns.online" OR destinationhostname CONTAINS "papa-johns-dostawa.digital" OR destinationhostname CONTAINS "papa-johns-dostawa.online" OR destinationhostname CONTAINS "login.wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.biz" OR destinationhostname CONTAINS "wallet-secure.me" OR destinationhostname CONTAINS "wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.site" OR destinationhostname CONTAINS "wallet-secure.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "idea-secure-login.com" OR destinationhostname CONTAINS "eonsabode.at" OR destinationhostname CONTAINS "biznesplanet-bnpparlba.com" OR destinationhostname CONTAINS "biznesplanet-parlbabnp.com" OR destinationhostname CONTAINS "biznesplanet-parlbas.com" OR destinationhostname CONTAINS "biznesplanet.parlbabnp.com" OR destinationhostname CONTAINS "login-biznesplanet.com" OR destinationhostname CONTAINS "bos24-logowan.com" OR destinationhostname CONTAINS "bos24-logowanie.com" OR destinationhostname CONTAINS "bos24-online.com" OR destinationhostname CONTAINS "ibos-online24.com" OR destinationhostname CONTAINS "ibos24-login.com" OR destinationhostname CONTAINS "ibos24-online.com" OR destinationhostname CONTAINS "login-bos24.com" OR destinationhostname CONTAINS "citationsherbe.at" OR destinationhostname CONTAINS "flowsrectifie.at" OR destinationhostname CONTAINS "odatingactualiz.at" OR destinationhostname CONTAINS "flash-player-update.digital" OR destinationhostname CONTAINS "flash-update.digital" OR destinationhostname CONTAINS "flashplayer-update.digital" OR destinationhostname CONTAINS "flashupdate.digital" OR destinationhostname CONTAINS "player-update.digital" OR destinationhostname CONTAINS "playerupdate.digital" OR destinationhostname CONTAINS "upgrade-flash-player.digital" OR destinationhostname CONTAINS "sso-cloud-idea.com" OR destinationhostname CONTAINS "dostawapapajohns.online" OR destinationhostname CONTAINS "onlinepapajohns.online" OR destinationhostname CONTAINS "papa-johns-dostawa.digital" OR destinationhostname CONTAINS "papa-johns-dostawa.online" OR destinationhostname CONTAINS "login.wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.biz" OR destinationhostname CONTAINS "wallet-secure.me" OR destinationhostname CONTAINS "wallet-secure.org" OR destinationhostname CONTAINS "wallet-secure.site" OR destinationhostname CONTAINS "wallet-secure.xyz")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("idea-secure-login.com/3/ddg.dll","eonsabode.at/kntwtopnbt/iqiw922vv5/AveBelial.xml")
