index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("83.171.237.173","192.99.221.77")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252","d035d394a82ae1e44b25e273f99eae8e2369da828d6b6fdb95076fd3eb5de142","94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916","48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0","ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088","ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330c")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "usaid.theyardservice.com" OR destinationhostname CONTAINS "worldhomeoutlet.com" OR destinationhostname CONTAINS "dataplane.theyardservice.com" OR destinationhostname CONTAINS "cdn.theyardservice.com" OR destinationhostname CONTAINS "static.theyardservice.com" OR destinationhostname CONTAINS "theyardservice.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "usaid.theyardservice.com" OR destinationhostname CONTAINS "worldhomeoutlet.com" OR destinationhostname CONTAINS "dataplane.theyardservice.com" OR destinationhostname CONTAINS "cdn.theyardservice.com" OR destinationhostname CONTAINS "static.theyardservice.com" OR destinationhostname CONTAINS "theyardservice.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "usaid.theyardservice.com" OR destinationhostname CONTAINS "worldhomeoutlet.com" OR destinationhostname CONTAINS "dataplane.theyardservice.com" OR destinationhostname CONTAINS "cdn.theyardservice.com" OR destinationhostname CONTAINS "static.theyardservice.com" OR destinationhostname CONTAINS "theyardservice.com")
index=activity AND rg_functionality="Email / Email Security" AND emailsender NOT NULL AND (emailsender CONTAINS "ashainfo@usaid.gov" OR emailsender CONTAINS "mhillary@usaid.gov")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailsender NOT NULL AND (emailsender CONTAINS "ashainfo@usaid.gov" OR emailsender CONTAINS "mhillary@usaid.gov")
