index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("88.99.66.31")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be351f0654045ac95d35f21dc94576adfcd8ee976f48f430db9be75569cd95f8","71f97ec74c9d00a4c22c2905692dd1933c0ec86afa8fe7800fcb06a92fc933ee","f15ec4e938667248ae7ec3f0c754bafa8b1978cd5ee043755854783d78d06ab9","1935d92f1fbc8a6ef85e72c7b25d80dabe8ea7db42c42446a3c01076c3aad750","38b605f9fac77ac0bf9b13067a13fe02ac76ebee5fbd11a0e0ca869f268a6b3c","5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d","14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e","e10a97b02915dc3b2962603b9d173043906c4ecb865c7a8a64c6dcee66d30967","ea50f0afe88df5256b2f596b8ecde1f12779f496cd9a7d482d2182d6f789a57f","d9bb8e2ccfb5f98ca1097224493dc4f166291ee7b11fd13eaf9d0ef3cd379807","e950dd74f002df712925abe0c8ed18cc0cf38c53e5cb57eb68610e00da14c0f3")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cheapdealnow.top" OR destinationhostname CONTAINS "f0473248.xsph.ru" OR destinationhostname CONTAINS "xsph.ru" OR destinationhostname CONTAINS "bbhmnn778.fun" OR destinationhostname CONTAINS "telete.in")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cheapdealnow.top" OR destinationhostname CONTAINS "f0473248.xsph.ru" OR destinationhostname CONTAINS "xsph.ru" OR destinationhostname CONTAINS "bbhmnn778.fun" OR destinationhostname CONTAINS "telete.in")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cheapdealnow.top" OR destinationhostname CONTAINS "f0473248.xsph.ru" OR destinationhostname CONTAINS "xsph.ru" OR destinationhostname CONTAINS "bbhmnn778.fun" OR destinationhostname CONTAINS "telete.in")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("f0473248.xsph.ru/ApplicationFrameHost.exe")
