index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.63.49.202","23.94.218.221","185.244.39.165")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("46e03f21a95afa321b88e44e7e399ec3","5c87b653db4cc731651526f9f0d52dbb","105885d14653932ff6b155d0ed64f926","601107fc8fef440defd922f00589e2e9","9939bf80b7bc586776e45e848ec41946","054e18a1aab1249f06a4f3e661e3f38a","e72d18b78362e068d0f3afa040df6a4c","ebc98d9c96065c8f1c0f4ce445bf507b","c7271b91d190a730864cd149414e8c43","00d7f155f1a9b29be2c872c6cad40026","2dc3ef988adca0ed20650c45735d4160","a52f1574e4ee4483479e9356f96ee5e3","b9ad53066ab218e40d61b299bd2175ba","f054f1ccc2885b45a71a1bcd0dd711be","b7373b976bbdc5356bb89e2cba1540cb","8884b0d29a15c1b6244a6a9ae69afa16","270ee9d4d22ca039539c00565b20d2e7","8debf9b41ec41b9ff493d5668edbb922","d56a4865836961b592bf4a7addf7a414","59368e712e0ac681060780e9caa672a6","99fed519715b3de0af954740a2f4d183","bd14674edb9634daf221606f395b1e1d","04d17caf8be87e68c266c34c5bd99f48","217943eb23563fa3fff766c5ec538fa4","fef0ec9054b8eff678d3556ec38764a6","32cc7dd93598684010f985d1f1cea7fd","1dc3711272f8e9a6876a7bccbfd687a8","da1d640dfcb2cd3e0ab317aa1e89b22a","31d07f99c865ffe1ec14c4afa98208ad","b5e0eb9ca066f5d97752edd78e2d35e7","b65d62fcb1e8f7f06017f5f9d65e30e3","933ffc08bcf8152f4b2eeb173b4a1e26","4ae0048f67e878fcedfaff339fab4fe3","1478906992cb2a8ddd42541654e9f1ac","33b4238e283b4f6100344f9d73fcc9ba","1f8178f9d82ac6045b6c7429f363d1c5","c7d19e496bcd81c4d16278a398864d60","1bae258e219c69bb48c46b5a5b7865f4","547334e75ed7d4eea2953675b07986b4")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "msupdata.com" OR destinationhostname CONTAINS "www.msupdate.com" OR destinationhostname CONTAINS "bundanesia.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "msupdata.com" OR destinationhostname CONTAINS "www.msupdate.com" OR destinationhostname CONTAINS "bundanesia.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "msupdata.com" OR destinationhostname CONTAINS "www.msupdate.com" OR destinationhostname CONTAINS "bundanesia.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://45.63.49.202/document.html","http://23.94.218.221/excelservice.html","http://45.63.49.202/doc.html","http://45.63.49.202/gabha.html")
