index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1fecb6eb98e8ee72bb5f006dd79c6f2f","4da2c2abcf1df9749b64b34160bd3ebf","5dc7fbf2141f7dfe5215c94895bf959c","70e9416833b2f933b765042f8e1ea0bc","8074f73f7742309b033676cd03eb0928","8ae40c8418b2c36b58d2a43153544ddd")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "http://email.yg9.me" OR destinationhostname CONTAINS "http://google.vrthcobj.com" OR destinationhostname CONTAINS "http://d.diragame.com" OR destinationhostname CONTAINS "toa.mygametoa.com" OR destinationhostname CONTAINS "tob.mygametob.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "http://email.yg9.me" OR destinationhostname CONTAINS "http://google.vrthcobj.com" OR destinationhostname CONTAINS "http://d.diragame.com" OR destinationhostname CONTAINS "toa.mygametoa.com" OR destinationhostname CONTAINS "tob.mygametob.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "http://email.yg9.me" OR destinationhostname CONTAINS "http://google.vrthcobj.com" OR destinationhostname CONTAINS "http://d.diragame.com" OR destinationhostname CONTAINS "toa.mygametoa.com" OR destinationhostname CONTAINS "tob.mygametob.com")
