index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("da8d01720b72d4924634030496665779624e5fbb291a6346bf54cb61beec5020","cf3d42642c7f3867849464351e2cdacab7b5c73f50f0ac7075583a8a210d6675","ad640f1084f2228aede77674dfa5078844fd4163694234021bfe72b73f30f060","ebe8e001726ccb5df470d650b4afd2fe6d4ae087e8aba9e1bcd18bbd217022d6","0f6b5e0bd39fa3eb5e33212d1c180bacf9441a908986bd5e36eadaddb22e80ea","f84b23d6d06956922d90093c2cc18f6cb23564285fc4b482f41eb5b360cb5874","0c649e8575cdd0baf7ffcbe08c1e906a0d6adcc3e7612c86ebdd93882854ddee","633d16bb4f3465574d0e020165fb4d3f2a2c94e440c521d8dc6034f9d369a989","7cfc8fdc124e034579cfd665c38fc3f66de2fa8e47350e09f8e91f6000f96b3f","add358e91095ffee6f3232965ecc4fdee386fea3a5e9b7bc540434aece1da3d1","7b6f26c5cdec1f5dc21c46cf26889ce1349629944fd45a684c94af1174c201df","83667a9a99db9e89d9b0d39b0cd2fb94c59085f4d3b7b3c37206228f22bdc081","9425d9099bf4dd1cd2c41434fe45de21ac1659110d121342849077eb6770437a","3ec0a49b394c159a2a2833fc5009948abf485d3328d37931c1a8e0469c784824","10666134095758789aa4d120d232945d")
index=activity AND rg_functionality="Endpoint Management Systems" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("3.124.142.205","185.204.1.236","149.154.154.78","3.134.39.220","3.127.181.115","3.134.125.175","91.109.178.2","3.67.112.102","1.1.1.1","3.64.4.198","3.133.207.110","3.125.188.168","91.192.100.37","195.123.221.123","37.1.217.131","147.185.221.224","3.141.142.211")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Content Management System" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Content Management System" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Microsoft Windows" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Microsoft Windows" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Microsoft Windows" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Microsoft Windows" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / VPN" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / VPN" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / VPN" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / VPN" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Content Management System" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Content Management System" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Content Management System" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Content Management System" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Virtualization / Containers" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Virtualization / Containers" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Privileged User" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Privileged User" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Privileged User" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Privileged User" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Identity Management" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Identity Management" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Identity Management" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Access / Identity Management" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Identity Access Management" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Identity Access Management" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Identity Access Management" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Identity Access Management" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / WiFi" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / WiFi" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "sanpedro1.duckdns.org")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "sanpedro1.duckdns.org")
