index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("184.185.103.157")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e6c043cd93e28feb16362ebb329f26f5c323f5c2389ad1bcec55fe033533dbf0","dbdccafd2ef3a6eeb6b11c684698df279ba843e5a23fae8d92dd2317cc6db3ee","c2535e800d505cb51e9c3e161e958162ede306a15d30f9316a31e16159187ac3","c110315c3b81bb6027c78dff280e5f1b2d3cd8a8dcf2ce0724941a8a40abf1ad")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://luno-offer-rewards.greekspeek.com/minerva-heathcote/documents.zip","http://forum.ennov8.com.ng/mr–torrey-satterfield/documents.zip","http://rrestetica.com/ffJWg/documents.zip","http://microlinsmmn.carajasnutricaoanimal.com.br/mr–simeon-labadie/documents.zip","http://shopifytest.recyclemymachine.com/mrs–hermina-welch-phd/documents.zip","http://backend.southernbellatl.co/prof–flossie-kuhn-jr-/documents.zip","http://appsolzone.com/chadrick-marvin/documents.zip","http://ulumequran.com/kasey-botsford/documents.zip","http://orgaproducts.com/deontae-mayer/documents.zip","http://stage1.artisanenterprisellc.com/dr–era-skiles/documents.zip","http://portal2.aladhwa-sch.com/nestor-dare/documents.zip","http://covid19.iqwasithealth.com/jillian-ratke-iii/documents.zip","http://catalogue.queensbridgenigeria.com/prof–leland-jaskolski-i/documents.zip","http://pavanalakecamping.com/mrs–jessika-sporer/documents.zip","http://bengheng-engrg.com/carmelo-metz-iii/documents.zip","http://seremanis.com/gregg-beier/documents.zip","http://inmobaperu.com/letitia-wintheiser/documents.zip","http://ayurskinclinic.com/elroy-emard/documents.zip","http://controlling2014.erp-corp.com/arvid-abbott/documents.zip","http://najihojeily.com/mr–kale-ebert-i/documents.zip","http://radiocakrabandung.com/prof–tremaine-gerlach-v/documents.zip","http://offlinesharks.com/prof–clark-hessel-md/documents.zip","http://connectavet.com/efren-crooks-iii/documents.zip","http://infotrekkingnepal.com/dr–dahlia-wisoky-phd/documents.zip","http://lookatmemarketing.com/EVzBd/documents.zip","http://calvano.com/prof–emil-rolfson/documents.zip","http://allyoulovetrading.com/emmanuelle-zemlak/documents.zip","http://viewmediads.com/dr–lucie-little/documents.zip","http://integrityadvisory.in/dedrick-osinski/documents.zip","http://enaruci.qwerty.ba/prof–dan-denesik-iii/documents.zip ","http://slsviews.magicways.in/mrs–margie-morissette/documents.zip","http://leonandsigourney.com/phoebe-wisozk/documents.zip","http://marketbling.com/daphne-hamill-phd/documents.zip","http://cac-itc.com/lola-wehner/documents.zip","http://germiterra.com/hanna-kuphal/documents.zip","http://tracking-centre-redelivery.idealnepaltours.com/lelia-jones-i/documents.zip","https://dharamdiwan.in/njipkUcz/ork.html","https://lenoirramosjr.com/7r9JyFLo/ork.html","https://dev.favterest.com/VBPFHU4UdmdT/filter.html","https://ethioshare.com/q22UgZzM3PV7/filter.html","https://nws.visionconsulting.ro/N1G1KCXA/dot.html","https://royalpalm.sparkblue.lk/vCNhYrq3Yg8/dot.html","https://arpanetwifi.com/6PJHScezZV/lora.html","https://victoriaholidays.co.in/JRO9RjMm/lora.html")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="24.95.61.62" AND destinationport=443) OR (destinationaddress="24.229.150.54" AND destinationport=995) OR (destinationaddress="45.77.117.108" AND destinationport=8443) OR (destinationaddress="76.94.200.148" AND destinationport=995) OR (destinationaddress="106.250.150.98" AND destinationport=443) OR (destinationaddress="187.250.238.164" AND destinationport=995) OR (destinationaddress="195.6.1.154" AND destinationport=2222))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="24.95.61.62" AND destinationport=443) OR (destinationaddress="24.229.150.54" AND destinationport=995) OR (destinationaddress="45.77.117.108" AND destinationport=8443) OR (destinationaddress="76.94.200.148" AND destinationport=995) OR (destinationaddress="106.250.150.98" AND destinationport=443) OR (destinationaddress="187.250.238.164" AND destinationport=995) OR (destinationaddress="195.6.1.154" AND destinationport=2222))
