index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("139.99.167.177")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4","fc781887fd0579044bbf783e6c408eb0eea43485","66534e53d8751a24a767221fed01268d","2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e","6114655cf8ddfd115156a1c450ba01e31887fabb","77605aa6bd6fb890b9b823bd7a3cc78b","776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b","247a32ebee0595605bab77fc6ff619f66740310b","e55d9f6300fa32458b909fded48ec2c9","a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf","19a751ff6c5abd8e209f72add9cd35dd8e3af409","600aceaddb22b9a1d6ae374ba7fc28c5","c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78","95227f426d8c3f51d4b9a044254e67a75b655d6a","8ece22e6b6e564e3cbfb190bcbd5d3b9")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "74d6b7b2.app.giftbox4u.com" OR destinationhostname CONTAINS "content.pcmsar.net" OR destinationhostname CONTAINS "hanproud.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "74d6b7b2.app.giftbox4u.com" OR destinationhostname CONTAINS "content.pcmsar.net" OR destinationhostname CONTAINS "hanproud.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "74d6b7b2.app.giftbox4u.com" OR destinationhostname CONTAINS "content.pcmsar.net" OR destinationhostname CONTAINS "hanproud.com")
