index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("213.16.63.201","62.38.35.22","194.31.52.174","18.235.127.50","32.221.40.2376")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a","b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778","2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec","c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799","6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b","a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce","b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0","6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05","e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80","63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9","715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7","c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40","19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d","5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28","0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049","fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0","39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bvprzqhoz72jltin.onion" OR destinationhostname CONTAINS "bvprzqhoz72jltin.tor2web.su" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ly" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ws")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bvprzqhoz72jltin.onion" OR destinationhostname CONTAINS "bvprzqhoz72jltin.tor2web.su" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ly" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ws")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bvprzqhoz72jltin.onion" OR destinationhostname CONTAINS "bvprzqhoz72jltin.tor2web.su" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ly" OR destinationhostname CONTAINS "bvprzqhoz72jltin.onion.ws")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("")
