index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "hoftpaeers.com" OR destinationhostname CONTAINS "rentry.co" OR destinationhostname CONTAINS "movilidadvialcolombia.com" OR destinationhostname CONTAINS "kbfvzoboss.bid" OR destinationhostname CONTAINS "alphastand.trade" OR destinationhostname CONTAINS "alphastand.win" OR destinationhostname CONTAINS "alphastand.top" OR destinationhostname CONTAINS "audi-a7-tuning.ru")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("192.64.118.167","62.182.159.147","95.213.145.101","13.234.135.58","20.2.7.40","23.254.119.234","130.43.3.118","202.151.161.172","46.246.163.216","94.103.86.38")
